Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company uses a SIEM to monitor authentication events. The security team wants to detect a 'golden ticket' attack, where an attacker forges a Kerberos ticket to gain access to any resource. Which monitoring approach would be most effective?

   • AMonitor for failed Kerberos authentication attempts.
   • BAlert on any Kerberos ticket that has a long validity period.
   • CMonitor for Kerberos ticket-granting ticket (TGT) requests that are not associated with a corresponding user authentication event.
   • DAlert on any successful login from a user account that has not logged in for more than 90 days.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it important to monitor multi-factor authentication (MFA) usage in authentication logs?

   • ATo verify that all users have MFA enabled
   • BTo reduce the number of MFA prompts for users
   • CTo detect attempts to bypass MFA or use stolen MFA tokens
   • DTo ensure that users are not using MFA too frequently, which can cause fatigue
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which method is commonly used to monitor the use of elevated privileges in a Windows environment?

   • AReviewing DNS query logs
   • BMonitoring Event ID 1102 (audit log cleared)
   • CMonitoring Event ID 4672 (special privileges assigned to new logon)
   • DMonitoring Event ID 4624 (successful logon)
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is implementing continuous monitoring for its identity infrastructure. The security team wants to ensure that all account lifecycle events (creation, modification, deletion) are captured and correlated with user activity. Which approach best achieves this goal?

   • AUse a third-party tool to periodically scan the directory for new accounts and compare it to a baseline.
   • BForward directory service logs to the SIEM and create alerts for any account creation or deletion outside of business hours.
   • CIntegrate the IAM system with the SIEM to ingest all identity events, and use a correlation rule to match account changes with the requesting user's session.
   • DEnable verbose logging on all domain controllers and review the logs manually on a weekly basis.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is investigating a potential brute-force attack on a VPN gateway. The logs show thousands of failed authentication attempts from a single IP address, but no successful logins. The analyst wants to determine if any accounts were compromised. What additional data source would be most useful?

   • AThe user account database to check if any of the targeted usernames have been recently created or modified.
   • BThe firewall logs to see if the IP address is known to be a proxy or anonymization service.
   • CThe VPN gateway's logs for successful MFA challenges, to see if any of the failed attempts were followed by a successful MFA prompt.
   • DThe SIEM's correlation rules to see if any alerts were triggered for the same IP address in the past.
   Reveal Solution Discussion Select an answer first