Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security analyst is reviewing centralized authentication and privileged access logs during an investigation. The following event log snippet was captured:

Timestamp: 2026-07-27 10:12:01 UTC | User: [email protected] | Src_IP: 192.168.10.45 | Auth_Type: SAML_SSO | Status: SUCCESS | Location: New York, USA
Timestamp: 2026-07-27 10:13:15 UTC | User: [email protected] | Src_IP: 203.0.113.19 | Auth_Type: SAML_SSO | Status: SUCCESS | Location: London, UK
Timestamp: 2026-07-27 10:13:40 UTC | User: [email protected] | Resource: DC-01.company.local | Privilege: Domain Admin Vault | Action: Checkout | Status: APPROVED

Based on the log entries above, which of the following represents the MOST likely incident root cause and the immediate identity and access management (IAM) operational response?

  1. An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.Answer
  2. B
    A network security control failure occurred; the analyst should add public IP 203.0.113.19 to the perimeter firewall blocklist to prevent further authentication attempts.
  3. C
    An authorization policy flaw exists in the SAML Single Sign-On configuration that incorrectly granted identity verification permissions to an unauthorized identity provider.
  4. D
    The internal connection from IP 192.168.10.45 is inherently secure, so no containment action is necessary as long as privileged account checkout policies were followed.

Answer

An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.
The log snippet reveals two successful logons for user [email protected] occurring 74 seconds apart from New York and London. This represents a classic 'impossible travel' anomaly, proving that valid account credentials or session tokens have been compromised. In IAM operations, the primary immediate containment action is to revoke all active tokens, end open sessions, and disable the account to prevent unauthorized domain administrator escalation.

Step-by-Step Solution

1
Analyze authentication log timestamps and locations
Identified two successful SAML SSO logons for the same user account from New York, USA and London, UK within 74 seconds of each other.
Physical travel between these locations in under two minutes is impossible, indicating credential compromise (such as token hijacking or credential harvesting).
2
Evaluate downstream actions taken by the compromised account
The compromised account successfully performed a privileged vault checkout for domain admin access on critical infrastructure.
Threat actors frequently leverage stolen standard account credentials to escalate privileges via Privileged Access Management (PAM) workflows.
3
Determine the appropriate IAM containment operation
Revoke active session tokens, invalidate refresh tokens, and temporarily disable the account.
Immediate account lifecycle suspension and active session termination stops ongoing unauthorized access across all enterprise services.

Key Concept

Impossible travel detection and immediate incident containment in IAM operations
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic