Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is investigating a potential credential-stuffing attack. They see a high volume of failed logins from many different IP addresses, but each IP address only attempts a few logins. What is the most likely explanation?

   • AThe attacker is using a botnet to distribute the attack across many IPs to evade IP-based rate limiting.
   • BThe attack is a brute-force attack on a single account.
   • CThe attack is a false positive caused by users forgetting their passwords.
   • DThe attack is coming from a single compromised account.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does integrating account monitoring with an IAM system enhance security monitoring?

   • AIt ensures that all users have the same level of access
   • BIt allows the IAM system to automatically grant admin rights to users
   • CIt replaces the need for authentication logs
   • DIt provides context about user roles, entitlements, and access policies, enabling more accurate detection of anomalous behavior
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why are dormant accounts considered a security risk?

   • AThey are the only accounts that can be used for privilege escalation
   • BThey are automatically granted additional privileges over time
   • CThey are more likely to have weak passwords because they are not used
   • DThey are often forgotten and may have unchanged credentials, providing a stealthy entry point for attackers
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In continuous monitoring, why is it important to include service accounts in account monitoring scope?

   • AService accounts often have elevated privileges and are not tied to a single user, making their misuse harder to attribute.
   • BService accounts are automatically disabled after 90 days of inactivity.
   • CService accounts are the only accounts that can be used for lateral movement.
   • DService accounts are exempt from password policies and therefore require no monitoring.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses a PAM solution that rotates service account passwords. The security team wants to monitor for unauthorized use of these service accounts. Which data source would provide the most reliable evidence of unauthorized use?

   • APAM session recordings and access logs showing who checked out the credential.
   • BNetwork flow logs showing connections to the service's server.
   • CSIEM alerts for failed logins using the service account.
   • DActive Directory logs showing when the service account password was changed.
   Reveal Solution Discussion Select an answer first