Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization is implementing MFA for all users. The security team wants to monitor the rollout to ensure it is effective. Which metric would be most indicative of a successful MFA implementation?

   • AThe number of users who have enrolled in MFA.
   • BThe number of help desk tickets related to MFA issues.
   • CThe percentage of successful logins that include an MFA challenge.
   • DThe number of failed MFA attempts.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team wants to centralize monitoring of authentication events from multiple sources, including VPN, web application, and cloud IAM. They want to detect a user who logs in from multiple sources within a short time. Which approach is most effective?

   • AAlert on any login from a new device.
   • BUse the VPN logs only, since they are the most important.
   • CForward all authentication logs to the SIEM and create a correlation rule that aggregates logins by user across sources.
   • DMonitor each source separately and manually compare logs.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has enabled MFA for all users. The security team wants to monitor for brute-force attacks against the VPN. Which data source would provide the most direct evidence of a brute-force attack?

   • AActive Directory logs showing password changes for user accounts.
   • BSIEM alerts for users who successfully authenticated with MFA.
   • CVPN gateway logs showing repeated failed authentication attempts from a single source IP.
   • DFirewall logs showing traffic to the VPN server's IP address.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has a policy that all privileged access must be monitored and logged. They use a PAM solution that requires users to check out admin credentials. The security team wants to ensure that the PAM solution is not bypassed. Which monitoring control would best detect a bypass?

   • AMonitor the PAM solution's logs for failed checkouts.
   • BReview the PAM solution's audit logs on a weekly basis.
   • CRequire users to submit a ticket for each admin access request.
   • DAlert on any direct login to a privileged account that does not go through the PAM solution.
   Reveal Solution Discussion Select an answer first
6. 35application · medium · select all that apply

   A security analyst is setting up continuous monitoring for a new identity management system. The analyst wants to ensure that all account lifecycle events are captured. Which of the following events should be monitored? (Select all that apply.)

   • AAccount lockout
   • BAccount modification
   • CAccount login
   • DAccount deletion
   • EAccount creation
   Check answers Discussion Select an answer first