Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing logs from a privileged access management (PAM) system. They notice that a user with a standard account has been granted temporary admin rights multiple times in the past week. The user's job role does not require admin access. What should the analyst do?

   • AInvestigate the reason for the repeated elevation requests and check if the user's manager has approved them.
   • BImmediately revoke the user's ability to request elevation and escalate to the security team.
   • CCheck if the user's account has been compromised by reviewing their recent login locations.
   • DIgnore the events because the PAM system logs all elevations, so there is an audit trail.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which account lifecycle event should be monitored to detect the creation of unauthorized backdoor accounts?

   • AAccount login events
   • BAccount creation events
   • CAccount password changes
   • DAccount lockout events
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which account type typically requires the most stringent monitoring because it has the potential to change security configurations and access controls?

   • APrivileged accounts
   • BStandard user accounts
   • CTemporary accounts
   • DGuest accounts
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization wants to detect credential-stuffing attacks against their web application. They have web server logs that include usernames and passwords (hashed). Which pattern in the logs would most likely indicate a credential-stuffing attack?

   • AA single IP address with a high volume of successful logins.
   • BA single username with many different passwords from the same IP address.
   • CMany failed logins for a single username from multiple IP addresses.
   • DMany different usernames, each with a single password attempt, from the same IP address.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to centralize monitoring of privileged access across on-premises Active Directory and cloud-based IAM. Which approach would provide the most unified view?

   • AEnable auditing on the on-premises AD only, since most privileged accounts are there.
   • BUse the cloud IAM's built-in reporting for all privileged access.
   • CManually export logs from both systems and combine them in a spreadsheet.
   • DDeploy separate SIEM connectors for each source and create a unified dashboard in the SIEM.
   Reveal Solution Discussion Select an answer first