Examkin

Question

Difficulty: HardIdentity and Access Management Operations

A security analyst at a global logistics firm is reviewing central SIEM authentication logs following an automated threat alert. The log snippet reveals the following sequential events:

text
[08:15:02 UTC] IdP_SSO SUCCESS User: [email protected] Src_IP: 198.51.100.45 (New York, US) Auth: SAML+FIDO2
[08:16:35 UTC] Legacy_VPN SUCCESS User: [email protected] Src_IP: 203.0.113.88 (London, UK) Auth: RADIUS/PAP
[08:18:10 UTC] PAM_Gateway ALERT User: [email protected] Direct SSH attempt to Core_DB bypassing PAM proxy

Based on these logs, which of the following measures should the security team implement to contain the threat and mitigate the underlying operational IAM vulnerability? (Select TWO.)

  1. Investigate potential credential harvesting or session hijacking indicated by the impossible travel time anomaly between authentication events.Answer
  2. Deprecate legacy authentication protocols that bypass cloud Identity Provider (IdP) conditional access policies and multi-factor authentication (MFA).Answer
  3. C
    Reconfigure perimeter firewall rules to automatically trust legacy VPN connections originating from known remote management IP pools.
  4. D
    Modify the user's authorization privilege level in Active Directory to prevent the SIEM from triggering alerts during legacy protocol sign-ins.

Answer

The security team must investigate potential credential harvesting or session hijacking indicated by the impossible travel anomaly, and deprecate legacy authentication protocols that bypass IdP conditional access and MFA controls.
The correct measures are analyzing the impossible travel anomaly (New York to London in 93 seconds) to detect compromised credentials or session theft, and disabling legacy authentication protocols (RADIUS/PAP) that allow threat actors to circumvent conditional access and MFA controls enforced by modern IdPs.

Step-by-Step Solution

1
Analyze SIEM authentication event timestamps and source locations.
Identified successful sign-in from New York via SAML+FIDO2 at 08:15:02 UTC followed by a successful sign-in from London via RADIUS/PAP at 08:16:35 UTC.
Authenticating from two distant geographic locations within 93 seconds represents an impossible travel scenario, indicating credential theft or compromise.
2
Evaluate authentication protocol weaknesses exposed in the logs.
Discovered that legacy RADIUS/PAP protocols remain enabled on the VPN gateway.
Legacy authentication mechanisms bypass modern IdP-enforced MFA and conditional access evaluation, creating an easily exploitable attack vector.
3
Select effective operational IAM remediation strategies.
Initiate incident response for credential harvesting/hijacking and disable/block legacy authentication protocols across all enterprise gateways.
These steps address both the immediate compromise incident and the architectural gap allowing protocol fallback attacks.

Key Concept

Identity and Access Management Operations Log Correlation and Legacy Protocol Hardening
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic