Account & Privilege Monitoring & Authentication GMON Practice Questions (Page 8)

Questions 36–37

1. 36expert · hard

   An organization has a policy that privileged accounts must be reviewed monthly. The security team wants to automate the detection of privileged accounts that have not been used in 30 days. They have a SIEM with authentication logs and a CMDB that lists all privileged accounts. Which approach is most effective?

   • AAlert on any privileged account that has a password older than 30 days.
   • BAlert on any account that has not logged in for 30 days.
   • CAlert on any account that has been a member of the Domain Admins group for more than 30 days.
   • DJoin the CMDB list of privileged accounts with SIEM authentication logs and alert on those with no logins in 30 days.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst notices that a service account is being used to log in interactively to a workstation. The service account is not supposed to have interactive logon rights. What is the best immediate action?

   • AChange the service account password.
   • BAlert on the interactive logon and investigate the source and purpose.
   • CAdd the service account to the local administrators group on the workstation.
   • DDisable the service account immediately.
   Reveal Solution Discussion Select an answer first