4.4 Architect Identity Accounting ISSAP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An organization is designing its IAM accounting architecture and must balance the need for comprehensive audit logging with the cost of storage and analysis. The organization has a limited budget and wants to focus on the most critical events. Which approach best balances these constraints?

   • ALog all events but use a low-cost storage tier with a long retention period, and rely on periodic manual analysis.
   • BLog only failed authentication events and administrative actions, and retain them for a shorter period to reduce costs.
   • CLog all authentication events, authorization changes, and administrative actions, and retain them for the maximum required period.
   • DConduct a risk assessment to identify the most critical events, then log those events and set retention periods based on regulatory requirements and risk.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary goal of implementing log retention and integrity practices?

   • ATo increase the speed of log analysis
   • BTo reduce the cost of log storage
   • CTo eliminate the need for log backups
   • DTo ensure logs are available for the required period and are protected from tampering
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing IAM logs to identify a potential account compromise. The analyst notices that a user account successfully authenticated from an IP address that is not in the organization's known range. The analyst wants to determine if this is a one-time event or part of a pattern. What is the most effective next step?

   • ACheck the logs for any failed authentication attempts from that IP address.
   • BDisable the user account immediately to prevent further access.
   • CSearch the logs for all authentication events from that IP address to see if other accounts have logged in from the same IP.
   • DReview the user's recent activity logs to see if they have logged in from unusual locations before.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large enterprise has a SIEM system that receives IAM logs from multiple sources. The security team is concerned about alert fatigue because the SIEM generates too many alerts for routine events. They want to prioritize alerts that indicate a potential account compromise. Which alerting strategy is most effective?

   • AAlert on any authentication event that occurs outside business hours.
   • BAlert on every failed authentication attempt for all users.
   • CAlert on any change to a user's group membership.
   • DCreate a correlation rule that triggers an alert when a user successfully authenticates from a new device or location and then performs a privileged action within a short time.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm is designing its IAM accounting architecture. The compliance team requires that authentication events be retained for at least seven years to meet regulatory requirements. The security operations team needs to detect and respond to brute-force attacks within minutes. The organization uses a cloud-based identity provider that offers a default log retention of 90 days and supports exporting logs to an external storage service. Which approach best satisfies both requirements?

   • AStore authentication logs on-premises in a write-once-read-many (WORM) device for seven years, and have the security team manually check the logs each morning for anomalies.
   • BRely on the identity provider's default 90-day log retention and configure the security operations team to review logs weekly for brute-force indicators.
   • CEnable the identity provider's built-in alerting for failed logins and extend the provider's log retention to seven years using the provider's configuration console.
   • DConfigure the identity provider to export authentication logs to an immutable external storage service with a seven-year retention policy, and set up real-time alerting on failed authentication patterns.
   Reveal Solution Discussion Select an answer first