IAM Auditing and Monitoring CSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of analyzing IAM audit trails?

   • ATo replace the need for encryption of data at rest
   • BTo ensure that all users have the same password
   • CTo identify anomalies and potential security incidents that may indicate unauthorized access or misuse
   • DTo automatically assign permissions to new users
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of IAM audit logging in a cloud environment?

   • ATo store user passwords and access keys in an encrypted format for recovery purposes
   • BTo automatically block any user who attempts to access a resource without proper permissions
   • CTo record and preserve a chronological trail of identity and access management events for security analysis and compliance
   • DTo provide a real-time dashboard of current user sessions and active permissions
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial institution must prove to a regulator that it reviews access to its cloud financial systems quarterly. The institution has IAM audit logs and a compliance reporting tool. What should the institution do to demonstrate compliance?

   • AStore all IAM audit logs in a separate bucket and never delete them.
   • BGenerate a quarterly IAM compliance report that lists who accessed the financial systems and have a manager review and sign it.
   • CConfigure an alert that notifies the security team when anyone accesses the financial systems.
   • DCreate a new IAM role for the regulator to access the financial systems directly.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary benefit of monitoring IAM activities in a cloud environment?

   • AIt guarantees that all users have the same level of access
   • BIt provides early detection of unauthorized access attempts and policy violations
   • CIt automatically resets user passwords when they are forgotten
   • DIt eliminates the need for multi-factor authentication
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst reviews IAM audit logs and finds that a service account used by a nightly batch job has been authenticating from a new geographic region for the past week. The job's success rate is unchanged, and no data exfiltration is detected. The organization requires least privilege and has a policy to disable unused credentials. What should the analyst do first?

   • ATreat it as a potential credential compromise and immediately rotate the service account key.
   • BCheck whether the batch job's infrastructure was recently migrated or scaled to a new region, then correlate with change tickets.
   • CDisable the service account and require the batch job to use a new account with a more restrictive policy.
   • DCreate an alert for any future authentication from that region and continue monitoring.
   Reveal Solution Discussion Select an answer first