Examkin

Question

Difficulty: Very hardIdentity and Access Management Operations

A security operations team is investigating an incident where an attacker maintained active access to enterprise cloud applications following the revocation of a compromised user's directory credentials. The centralized Identity Provider (IdP) successfully initiated password resets and disabled the directory account in response to a SIEM alert, yet the attacker continued performing privileged actions in single sign-on (SSO) web applications for several hours. Which of the following operational root causes directly contributed to this continuous unauthorized access and failure of immediate session termination? (Select TWO.)

  1. The Identity Provider revoked user refresh tokens without invalidating active stateless JSON Web Tokens (JWTs) or clearing active session caches at the Relying Party applications.Answer
  2. The application architecture relied on standard OAuth 2.0 access token lifetimes without implementing Continuous Access Evaluation Protocol (CAEP) or real-time event-driven session revocation.Answer
  3. C
    The Security Operations Center failed to reconfigure the enterprise RADIUS server to re-authenticate local network interface controllers via TACACS+ PAP fallbacks.
  4. D
    The zero trust identity gateway delegated authorization decisions to localized endpoint firewalls using Attribute-Based Access Control (ABAC) rather than centralized RADIUS accounting.

Answer

The persistent access was caused by the IdP revoking refresh tokens without invalidating active stateless JWT access tokens or session caches at the application tier, alongside the absence of Continuous Access Evaluation Protocol (CAEP) integration to communicate real-time credential revocation events to relying applications.
In modern federated IAM architectures, revoking credentials at the identity provider (IdP) stops new authentication requests and refresh token usage. However, active sessions established via stateless access tokens (such as JSON Web Tokens) remain valid at relying applications until their expiration time unless active token invalidation (or session cache clearing) is performed. Furthermore, implementing Continuous Access Evaluation Protocol (CAEP) allows identity providers to push real-time security events (e.g., credential revocation, user disablement) directly to relying parties, enabling immediate termination of active sessions across applications.

Step-by-Step Solution

1
Analyze the IAM session flow and revocation mechanics
Disabling an account or revoking refresh tokens in an IdP stops new authentication attempts and token refreshes, but does not inherently revoke currently active access tokens already issued to client applications.
Stateless access tokens (like JWTs) are verified digitally by applications without querying the IdP on every API request until the token expires.
2
Evaluate real-time event integration protocols between IdPs and Relying Parties
Without CAEP or shared signals framework (SSF), relying party applications operate in isolation from IdP status changes until existing token lifetimes lapse.
CAEP enables real-time synchronization of security events (e.g., account disablement, session revocation) between identity providers and service providers.
3
Identify misattributed infrastructure controls
Network perimeter firewalls, RADIUS servers, and TACACS+ AAA configurations govern network access and infrastructure device logins, not web SSO access token lifecycles.
Operational IAM incident response requires distinguishing identity protocol mechanics (OAuth/OIDC/SAML) from network layer AAA controls.

Key Concept

Federated Identity Session Lifecycles & Real-Time Revocation (CAEP/JWT Invalidation)
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic