IAM Auditing and Monitoring CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's security team wants to be notified when a user account is created with administrative privileges, because that is a common precursor to privilege escalation. They already have a centralized logging pipeline that receives IAM audit logs. What should they configure?

   • AA log-based alert that triggers when the audit log contains an event for creating a user with an admin policy attached.
   • BAn alert on the number of failed login attempts across the entire organization.
   • CA budget alert on the IAM service costs.
   • DA daily report that lists all users with administrative privileges.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company must provide a compliance report to auditors showing that all IAM changes were reviewed and approved. The company uses AWS and has a change management process that requires a ticket number for each change. The auditors want to see the ticket number associated with each IAM change. What is the best way to ensure that this information is available in the audit trail?

   • AUse CloudTrail's 'requestParameters' field to capture the ticket number as a tag on the IAM resource.
   • BImplement a custom solution that requires users to include the ticket number in the 'sessionName' field of the STS token used to make the API call.
   • CUse AWS Config to record the ticket number as a resource tag on the IAM policy.
   • DRequire users to include the ticket number in the 'userAgent' field when making IAM API calls.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing IAM audit logs and notices that a user who normally logs in from the United States has a successful login from an IP address in a country that the company does not do business with. The login occurred at 2:00 AM local time. What should the analyst do next?

   • AAdd the user to a watch list and monitor for further anomalies.
   • BInvestigate the login event by correlating with other logs, such as VPN access or device information, before taking action.
   • CIgnore the event because it is just one login.
   • DImmediately disable the user's account and reset their password.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to detect when a user attempts to access a cloud resource they are not authorized to access. The company uses AWS and has enabled CloudTrail. What is the most effective way to monitor for these unauthorized access attempts?

   • AEnable IAM Access Analyzer to generate findings for unauthorized access.
   • BReview IAM policies to see which users have access to which resources.
   • CCreate a CloudWatch metric filter for 'AccessDenied' events in CloudTrail logs and set an alarm.
   • DUse AWS Config to track resource configurations and detect unauthorized access.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When responding to an IAM alert about a suspicious sign-in, what is the first step a security analyst should take?

   • AVerify the alert details and assess the risk before taking action
   • BSend a mass email to all users asking if they logged in
   • CIgnore the alert if the user is a senior executive
   • DImmediately disable the user's account without further investigation
   Reveal Solution Discussion Select an answer first