IAM Auditing and Monitoring CSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is reviewing IAM audit logs and finds that a user's access key was used to call the 's3:PutObject' API from an IP address that is not associated with the user's usual location. The analyst also notices that the user has not changed their password in over a year. The company has a policy that requires passwords to be changed every 90 days. What is the most likely explanation for this anomaly?

   • AThe user's password is expired, and they are using an access key to bypass the password policy.
   • BThe user is traveling and used a different IP address to access the resource.
   • CThe user's access key has been compromised and is being used by an attacker.
   • DThe analyst should investigate further by correlating the IP address with other logs and checking if the user has recently traveled.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of IAM compliance reporting?

   • ATo demonstrate adherence to regulatory and organizational policies regarding access control
   • BTo automatically grant temporary access to all users
   • CTo store user passwords in plain text for easy retrieval
   • DTo increase the number of user accounts in the system
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which method is commonly used to monitor IAM activities such as user sign-ins and access attempts in a cloud environment?

   • AAnalyzing network packet captures from the cloud provider's backbone
   • BEnabling and reviewing cloud provider audit logs that record authentication and authorization events
   • CReviewing the cloud provider's physical security camera footage
   • DConducting periodic interviews with all cloud users
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is investigating a potential security incident where a user's credentials may have been compromised. The company uses Azure AD. Which audit log should the investigator analyze first to understand the scope of the compromise?

   • AAzure AD Identity Protection reports to see risk detections.
   • BAudit logs for directory changes to see if the user's permissions were modified.
   • CProvisioning logs to see if the user was created or modified.
   • DSign-in logs to see all authentication attempts for the user.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a typical component of an IAM audit log entry?

   • AThe full contents of the user's access token
   • BThe user's social security number
   • CThe user's current IP address and GPS location
   • DThe timestamp, user identity, action performed, and resource affected
   Reveal Solution Discussion Select an answer first