IAM Auditing and Monitoring CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security engineer needs to ensure that all IAM changes, such as policy modifications and role assignments, are recorded for later analysis. The cloud provider's IAM service supports audit logging. What should the engineer do?

   • AUse a configuration management database to manually record changes.
   • BEnable only data-access logging for storage services.
   • CEnable IAM audit logging and configure it to capture all admin activity, including policy changes and role assignments.
   • DEnable VPC flow logs to capture network traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to be notified when a user fails to authenticate more than five times within a 10-minute window. The team uses AWS IAM and CloudTrail. What is the most effective way to implement this alert?

   • AEnable IAM Access Analyzer and configure it to send alerts on failed logins.
   • BSet up a CloudWatch Events rule that triggers on every 'ConsoleLogin' event and sends an email.
   • CCreate a CloudWatch Logs metric filter on CloudTrail logs for 'ConsoleLogin' events with a failure status, and set an alarm on the metric.
   • DUse AWS Config rules to detect multiple failed logins.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company must produce a compliance report showing that all IAM users have not used their passwords for more than 90 days. The company uses Google Cloud. What is the most efficient way to generate this report?

   • AUse the Reports API in Google Cloud Identity to export user sign-in activity.
   • BManually check each user's last sign-in time in the Admin console.
   • CUse Cloud Audit Logs to see when users authenticated.
   • DUse Cloud Asset Inventory to export user information.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization's IAM audit logs show that a user has been logging in from a new device and then immediately changing their password. This has happened three times in the past week. The user is a remote employee who recently got a new laptop. The organization has a policy that requires investigation of any password change. What should the organization do?

   • ADisable the user's account immediately and require a security review.
   • BInvestigate the audit logs to confirm the device is the user's new laptop and check if the password changes were initiated by the user.
   • CIgnore the activity because the user is a remote employee and may have multiple devices.
   • DCreate an alert for any future password changes and continue monitoring.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company must comply with a regulation that requires quarterly reviews of all IAM policies and user access rights. The company uses Google Cloud. What is the most efficient way to automate this compliance reporting?

   • AManually review the IAM policies in the Google Cloud Console each quarter.
   • BSet up a Cloud Scheduler job to email the current IAM policy to the security team.
   • CUse Cloud Audit Logs to see who accessed the IAM policy page.
   • DUse Cloud Asset Inventory to export IAM policies and compare them with previous exports.
   Reveal Solution Discussion Select an answer first