Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization's identity team is reviewing the account lifecycle process. They notice that when an employee leaves, their account is disabled but not deleted. The security team wants to ensure that these disabled accounts are not a risk. What is the most important monitoring control to implement?

   • AAutomatically delete disabled accounts after 30 days to reduce the attack surface.
   • BPeriodically review the list of disabled accounts to ensure they are still disabled.
   • CAlert on any authentication attempt using a disabled account, regardless of the source.
   • DRequire a manager to approve any attempt to re-enable a disabled account.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company uses multiple identity providers (IdPs) for different applications. The security team wants to centralize monitoring of authentication and privilege usage across all IdPs. Which approach is most effective?

   • ARely on the IdPs' built-in reporting tools and review them monthly.
   • BConfigure each IdP to send its authentication and authorization logs to a central SIEM, and create correlation rules to detect cross-IdP anomalies.
   • CManually review the logs from each IdP on a rotating basis.
   • DUse a single IdP for all applications to simplify monitoring.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What pattern in authentication logs is most indicative of a brute-force attack?

   • AMultiple failed login attempts followed by a successful login
   • BA user logging in from the same location at the same time every day
   • CA single successful login from a new device
   • DAn account being locked out after a single incorrect password
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An auditor requires that all user accounts be reviewed quarterly for necessity. The security team wants to automate the identification of accounts that have not been used in 60 days. What is the most effective way to do this?

   • AList all accounts that have not had their group memberships changed in 60 days.
   • BQuery Active Directory for accounts with a password last set more than 60 days ago.
   • CReview all accounts that have been disabled by the help desk in the last 60 days.
   • DQuery the SIEM for accounts with no successful authentication events in the last 60 days.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses an IAM system that provisions and deprovisions accounts. The security team wants to detect when a user is provisioned with privileged access that was not approved. Which integration would best support this?

   • AConfigure the SIEM to alert on any successful login by a user with a privileged role.
   • BEnable auditing on the domain controller and alert on any new user account creation.
   • CForward IAM approval workflow logs to the SIEM and alert on any privileged role assignment without a matching approval record.
   • DHave the IAM system send email notifications to the security team for every role assignment.
   Reveal Solution Discussion Select an answer first