4.4 Architect Identity Accounting ISSAP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of a log analysis report?

   • AA schedule for log rotation
   • BA monthly summary of failed login attempts
   • CA list of all network devices
   • DA diagram of the network topology
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which regulation primarily focuses on the protection of personal data and privacy, including requirements for data minimization and purpose limitation?

   • AHIPAA
   • BGDPR
   • CPCI-DSS
   • DFISMA
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare organization is defining audit events for its IAM system to comply with HIPAA. The system includes a web portal for patients, an internal EHR application, and a directory service. The security team wants to ensure that any access to protected health information (PHI) is traceable. Which set of audit events is most appropriate to meet this requirement?

   • ALog only failed authentication attempts and successful administrative actions, as these are the most security-relevant events.
   • BLog successful and failed authentication, authorization changes, administrative actions, and data access events on the EHR application that contains PHI.
   • CLog all events from the patient web portal, including page views and form submissions, to capture every interaction.
   • DLog all successful and failed authentication attempts, all authorization changes, and all administrative actions on the directory service.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization's security operations center (SOC) is overwhelmed by alerts from its IAM system. The system logs every authentication event, including routine service account logins that occur every few minutes. The SOC wants to reduce alert fatigue while still detecting anomalous behavior. Which approach best achieves this goal?

   • ACreate a baseline of normal authentication patterns and configure alerts only for deviations from the baseline, such as unusual login times or locations.
   • BDisable alerting for all authentication events and rely on periodic manual log reviews by the SOC.
   • CAlert on every failed authentication attempt but suppress alerts for successful logins.
   • DIncrease the severity level of all authentication alerts so the SOC prioritizes them over other alerts.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is investigating a potential insider threat. The analyst has access to IAM logs that include authentication events, authorization changes, and administrative actions. The analyst suspects that a user may have accessed sensitive data without authorization. Which log analysis approach is most effective to confirm this suspicion?

   • ASearch for failed authentication attempts for the user's account.
   • BReview the user's authorization change history to see if they were granted additional permissions.
   • CCheck the user's administrative actions to see if they performed any unusual tasks.
   • DCorrelate the user's authentication events with data access logs from the sensitive data repository.
   Reveal Solution Discussion Select an answer first