IAM Auditing and Monitoring CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A cloud administrator notices that a service account is making API calls at 3:00 AM every day, even though the associated application is only scheduled to run during business hours. The administrator wants to be alerted immediately if this pattern continues. What should the administrator do first?

   • ARotate the service account's keys and update the application.
   • BReview the IAM policy to see who has access to the service account.
   • CCreate a CloudWatch/Cloud Monitoring alert that triggers when API calls are made outside business hours.
   • DDisable the service account's keys immediately.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company uses a cloud provider's native IAM service. The security team needs to know which users attempted to access a sensitive storage bucket and whether those attempts succeeded. They also want an alert when a user tries to access the bucket from an IP address outside the corporate range. What should the team configure?

   • AEnable VPC flow logs and configure a log-based alert for any traffic to the storage service.
   • BEnable audit logging for the storage service and create a metric-based alert on the log entries for denied access from external IPs.
   • CEnable CloudTrail and create a billing alert for the storage bucket.
   • DEnable IAM Access Analyzer and review its findings weekly.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of configuring alerts for suspicious IAM activities?

   • ATo automatically delete all user accounts when an alert is triggered
   • BTo notify security personnel immediately when potential security threats are detected
   • CTo increase the number of login attempts allowed
   • DTo replace the need for regular security audits
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   When analyzing IAM audit trails, which pattern is most indicative of a potential security incident?

   • AA user accesses a resource they have permission to use during business hours
   • BA user logs in from the same IP address at the same time each day
   • CA user changes their password every 90 days as required by policy
   • DA user successfully logs in after several failed attempts from a new geographic location
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An auditor asks for evidence that no user has been assigned the 'Global Administrator' role in Azure AD without proper approval. The company has a process where all role assignments must be approved by a manager. What is the best way to demonstrate compliance?

   • AShow the Azure AD audit logs for role assignments and cross-reference them with approval records.
   • BUse Azure AD Privileged Identity Management (PIM) to activate roles and show the activation history.
   • CRun a PowerShell script to list all role assignments and email it to the auditor.
   • DProvide a screenshot of the current Global Administrator list.
   Reveal Solution Discussion Select an answer first