Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security administrator is auditing authentication and access logs from an enterprise remote access gateway for external contractors:

[2026-07-27 10:14:02] RADIUS-AUTH: User 'contractor_jb' LDAP authentication SUCCESS.
[2026-07-27 10:14:03] MFA-SVC: User 'contractor_jb' TOTP verification SUCCESS.
[2026-07-27 10:14:03] RADIUS-AUTH: Network Access Policy evaluation: User group 'Vendor-Temp' assigned VLAN 102.
[2026-07-27 10:14:05] RADIUS-AUTH: Authorization OVERRIDE: Local static table mapped 'contractor_jb' to 'Domain Admins' (VLAN 10).
[2026-07-27 10:14:06] VPN-GW: Session established for 'contractor_jb' with Administrative Privileges on VLAN 10.

Based on the log analysis, which of the following root causes and operational remediation actions are correct? (Select TWO.)

  1. An authorization control failure occurred because a local RADIUS server mapping superseded centralized Directory role assignment, resulting in excessive privileges.Answer
  2. The security administrator must remove static local authorization overrides on the RADIUS server to enforce centralized least-privilege role assignment.Answer
  3. C
    An authentication protocol failure occurred because LDAP credential verification was bypassed in favor of TOTP token validation.
  4. D
    The local override setting should be classified as a detective security control failure rather than a preventive authorization policy misconfiguration.

Answer

The incident stems from an authorization control failure where local RADIUS static mapping tables overridden centralized group assignment, granting administrative privileges. To remediate this, the administrator must eliminate local static authorization overrides to enforce centralized least privilege.
The log explicitly demonstrates that both primary authentication (LDAP) and secondary authentication (TOTP MFA) succeeded. However, after the network access policy initially assigned the temporary vendor group profile, a local static table on the RADIUS server performed an authorization override to 'Domain Admins'. Removing local static overrides ensures that authorization rights remain aligned with centralized directory roles.

Step-by-Step Solution

1
Analyze authentication entries in the log.
LDAP authentication and TOTP MFA verification both succeeded for 'contractor_jb' at 10:14:02 and 10:14:03.
Confirms identity verification (AAA authentication phase) functioned properly.
2
Evaluate authorization processing entries.
Network Access Policy evaluated the group 'Vendor-Temp' (VLAN 102), but a subsequent local static table entry overridden the authorization assignment to 'Domain Admins' (VLAN 10).
Identifies that local configuration overrides defeated centralized role-based access control.
3
Determine appropriate operational remediation.
Remove local static table overrides on the RADIUS server.
Restores centralized directory-driven authorization and enforces least privilege.

Key Concept

RADIUS Centralized Authorization vs. Local Server Overrides in IAM Operations
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic