Examkin

Soru

Zorluk: ZorIdentity and Access Management Operations

A security analyst is reviewing authentication and session logs from an enterprise Identity Provider (IdP) following a suspected compromise of a cloud-hosted infrastructure management console. The investigation reveals the following log snippet:

[2026-07-27T14:02:11Z] AUTH_SUCCESS [email protected] AuthMethod=FIDO2_HardwareKey SourceIP=192.168.10.45 Location=Corp_HQ_HQ1
[2026-07-27T14:02:14Z] SESSION_ISSUED [email protected] OAuthTokenID=tk-998231 Scope=CloudAdmin_FullAccess
[2026-07-27T14:02:40Z] API_CALL [email protected] OAuthTokenID=tk-998231 SourceIP=198.51.100.77 Location=External_Unknown Endpoint=/api/v1/iam/roles/delete
[2026-07-27T14:02:45Z] API_CALL [email protected] OAuthTokenID=tk-998231 SourceIP=198.51.100.77 Location=External_Unknown Endpoint=/api/v1/storage/exportAll

Further physical access logs confirm User j.doe was continuously present at Corporate HQ during this timeframe. Which of the following identity operational vulnerabilities MOST likely enabled this unauthorized access? (Select TWO.)

  1. Absence of continuous access evaluation (CAE) or token binding allowing a stolen OAuth bearer token to be replayed from an external source IP addressCevap
  2. Failure to enforce location-aware risk policies that trigger step-up MFA or session revocation when anomalous client network context is detectedCevap
  3. C
    A failure in the role-based authorization policy that allowed the identity provider to grant excessive entitlement scopes during initial authentication
  4. D
    Incorrect classification of the perimeter firewall log collection system as a corrective security control rather than a detective monitoring control

Cevap

The compromise was enabled by the lack of continuous access evaluation (or sender-constrained token binding) allowing token replay, alongside missing location-aware risk policies to enforce step-up MFA upon context shift.
The scenario highlights session hijacking/token theft where a legitimate token generated during hardware key authentication at HQ was executed from an unknown external IP address. The two primary identity operation breakdowns are: 1) Using unconstrained bearer tokens without Continuous Access Evaluation (CAE) to bind sessions to device/network posture, and 2) Lacking adaptive, location-aware risk rules that automatically flag impossible travel or demand step-up MFA when session origin changes abruptly.

Adım Adım Çözüm

1
Analyze the authentication and API activity timestamps and attributes
The user authenticated successfully at HQ using a FIDO2 hardware key, but 26 seconds later, the resulting OAuth session token was utilized from an external IP address (198.51.100.77).
This discrepancy indicates a session token theft/replay attack or adversary-in-the-middle (AiTM) proxy interception.
2
Identify session validation operational controls needed to mitigate token replay
Without Continuous Access Evaluation (CAE) or sender-constrained token mechanisms (such as DPoP/mTLS), bearer tokens can be used from any device regardless of network origin change.
Standard bearer tokens do not validate client network posture dynamically after initial issuance.
3
Evaluate risk-based authentication triggers
The Identity Provider failed to detect impossible travel / network context shifts or mandate step-up MFA/re-authentication when an external IP attempted administrative API calls.
Modern IAM operations require adaptive access control policies that dynamically assess real-time risk metrics.

Anahtar Kavram

Session Token Binding & Adaptive Risk-Based Access Control
Bu soruyu puanla

Konular

Identity and Access Management Operations

Bu konudan daha fazla soru