Examkin

Question

Difficulty: HardIdentity and Access Management Operations

An IAM administrator at an enterprise health system is conducting emergency offboarding for a compromised account. The administrator disables the user's account in the on-premises Active Directory. However, an hour later, security operations detects ongoing unauthorized administrative API calls performed in the cloud SaaS platform using that identity. Upon reviewing the SCIM bridge synchronization logs, the analyst observes the following log entries:

[2026-07-27 14:02:11] WARN scim_sync_engine: PATCH /Users/usr_88291 HTTP/1.1 429 Too Many Requests - Rate limit exceeded. Account deprecation push failed.
[2026-07-27 14:02:11] INFO scim_sync_engine: Exponential backoff retry scheduled for 14,400 seconds.
[2026-07-27 14:15:00] AUDIT saas_api_gateway: Token authentication successful for usr_88291 via Bearer JWT. Active session valid.

Which of the following operational remediation actions should the analyst take FIRST to immediately terminate the unauthorized active cloud session?

  1. Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.Answer
  2. B
    Manually force an immediate full sync on the SCIM bridge connector to overwrite the rate-limiting backoff timer.
  3. C
    Reset the compromised user's password in the on-premises Active Directory to force token re-validation.
  4. D
    Deploy an emergency block rule on the edge firewall targeting the outbound destination IP addresses of the cloud SaaS platform.

Answer

Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.
Directly revoking the active OAuth 2.0/JWT session and refresh tokens within the cloud SaaS administrative portal is the most direct and immediate operational control to kill the compromised session. Because the SCIM provisioning bridge failed due to HTTP 429 rate limiting, relying on automated account disabling will take up to four hours (the scheduled backoff period). Explicit session revocation invalidates the bearer token at the cloud gateway immediately.

Step-by-Step Solution

1
Analyze the log entries to identify the root cause of ongoing unauthorized access.
The SCIM synchronization bridge failed to push the disabled account status to the cloud provider due to HTTP 429 rate limiting, leaving the account active in the cloud while an active JWT bearer token remained valid.
Stateless authentication tokens (JWTs) remain valid until expiration or explicit token revocation at the API gateway/identity provider.
2
Evaluate containment actions for immediate session termination.
Directly revoking session tokens inside the SaaS portal terminates active sessions immediately without waiting for automated provisioning sync retries.
Token revocation is the primary operational response for terminating active session hijackings or compromised identity tokens.

Key Concept

Identity Lifecycle Operations and Active Session Revocation
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic