Examkin

Question

Difficulty: HardIdentity and Access Management Operations

A Security Operations Center (SOC) analyst is reviewing Identity and Access Management (IAM) event logs following an automated alert regarding an unauthorized privilege escalation attempt. The following log snippet was retrieved from the central SIEM:

[2026-07-27 10:02:11] IdP_AUTH SUCCESS user="j.smith" realm="corp.internal" src_ip="10.10.4.12" auth_method="MFA_TOTP"
[2026-07-27 10:02:14] PAM_ELEVATE_REQ user="j.smith" target_role="DomainAdmin" verified_group_membership=["Helpdesk_L1"]
[2026-07-27 10:02:15] PAM_POLICY_EVAL user="j.smith" rule="Trust_Internal_Subnet_AutoApprove" match=TRUE
[2026-07-27 10:02:16] PAM_SESSION_START user="j.smith" effective_role="DomainAdmin" status="GRANTED"

Based on the log data, which of the following operational root causes explains why `j.smith` was granted the `DomainAdmin` role?

  1. The Privileged Access Management system authorized access based on network location rather than enforcing entitlement checks against the user's verified identity group.Answer
  2. B
    The primary Identity Provider failed to properly authenticate the user during the initial login sequence before requesting privilege elevation.
  3. C
    An external threat actor conducted a real-time credential harvesting attack to bypass multi-factor authentication controls.
  4. D
    The automatic subnet approval rule operated as a compensating corrective control to maintain helpdesk operational continuity.

Answer

The Privileged Access Management system authorized access based on network location rather than enforcing entitlement checks against the user's verified identity group.
The correct answer identifies that the Privileged Access Management engine performed flawed authorization. While the user was successfully authenticated via MFA, the PAM policy automatically granted `DomainAdmin` rights due to an internal IP trust rule (`Trust_Internal_Subnet_AutoApprove`), completely bypassing role-based group checks that showed the user only belonged to `Helpdesk_L1`.

Step-by-Step Solution

1
Analyze the authentication entry in the log snippet.
The entry `[2026-07-27 10:02:11] IdP_AUTH SUCCESS user="j.smith"... auth_method="MFA_TOTP"` shows identity verification (authentication) succeeded cleanly.
Establishes that the user identity was properly validated via multi-factor authentication.
2
Examine the privilege elevation request and group memberships.
The user `j.smith` belongs to `Helpdesk_L1` but requested `DomainAdmin` elevation.
Helps determine whether the user inherently possesses the authorization required for DomainAdmin rights.
3
Evaluate the policy decision entry from the PAM platform.
`PAM_POLICY_EVAL` matched `Trust_Internal_Subnet_AutoApprove`, leading to `PAM_SESSION_START` with status `GRANTED`.
Reveals that access elevation occurred because of an IP/location-based implicit trust rule overriding role entitlement checks.

Key Concept

Privileged Access Management (PAM) Authorization and Zero Trust Principles
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic