A security analyst is investigating an authentication alert involving an enterprise user account. Log analysis indicates that the account completed a successful multi-factor authentication (MFA) login from a corporate desktop in Chicago. Less than ten minutes later, authentication logs show successful access to cloud resources using the same account credentials via legacy POP3/IMAP protocols from an unmanaged external IP address, bypassing MFA prompts. Which of the following operational actions should the analyst take to contain the immediate risk and prevent future occurrences of this issue? (Select TWO.)
- Revoke all active refresh tokens and terminate existing active sessions for the compromised user accountCevap
- Disable legacy authentication protocols within the enterprise identity provider conditional access policiesCevap
- CAdd the external IP address range to the identity provider's trusted location whitelist to suppress alerts
- DModify the user's role-based authorization privileges to read-only status in the active directory domain
Cevap
The analyst should immediately revoke all active refresh tokens and terminate active sessions for the user account, and disable legacy authentication protocols within the identity provider policies.
Revoking active sessions cuts off existing unauthorized access from token reuse, while disabling legacy authentication protocols prevents attackers from bypassing multi-factor authentication mechanisms via protocol downgrade vectors.
Adım Adım Çözüm
Anahtar Kavram
Legacy Authentication Mitigation and Session Invalidation