Examkin

Soru

Zorluk: Çok zorIdentity and Access Management Operations

A security operations team reviews the following event logs from an enterprise Identity and Access Management (IAM) environment during an incident post-mortem:

text
[2026-07-27 14:02:11] RADIUS_AUTH: User 'j_doe' authenticated via EAP-TLS from IP 192.168.10.45. Assigned Role: Tier-1 Helpdesk.
[2026-07-27 14:05:30] PAM_VAULT: User 'j_doe' requested emergency break-glass checkout for 'sa_db_admin'. Approval: Automated (Ticket #9842).
[2026-07-27 14:05:31] TACACS_CMD: User 'j_doe' (as 'sa_db_admin') executed privileged command 'GRANT ALL PRIVILEGES ON prod_db.* TO 'j_doe'@'%''.
[2026-07-27 14:15:00] PAM_VAULT: Emergency break-glass session expired for 'sa_db_admin'. Password rotated automatically in Vault.
[2026-07-27 14:30:12] DB_AUDIT: User 'j_doe' logged into 'prod_db' directly from IP 10.200.5.12 using personal credentials with persistent global privileges.

Which of the following operational control failures allowed the user to maintain unauthorized database access after the Privileged Access Management (PAM) session expired?

  1. The break-glass operational policy permitted interactive command execution that altered target database access control lists directly, establishing an out-of-band persistent entitlement.Cevap
  2. B
    The PAM vault failed to perform automated password rotation within the configured time window, enabling credential reuse of the break-glass account.
  3. C
    The RADIUS server authenticated the initial network access connection without validating database-level authorization policies.
  4. D
    The database server accepted incoming connections from an internal IP address without inspecting perimeter firewall traffic rules.

Cevap

The operational control failure occurred because the break-glass policy allowed interactive command execution that modified target database access control lists directly, creating an out-of-band persistent access path.
The correct answer identifies that the primary operational weakness was allowing unrestricted administrative command execution during a PAM break-glass session. When an administrative workflow lacks command blacklisting or change management integration, an operator can alter local access control lists (ACLs) to grant their unprivileged account persistent direct access. Even though the PAM system properly rotated the shared account credential upon expiration, the out-of-band permission modification on the database persisted.

Adım Adım Çözüm

1
Analyze the log timeline and user actions during the PAM session.
At 14:05:31, while using the break-glass account 'sa_db_admin', user 'j_doe' executed a SQL command granting global privileges to their personal user account ('j_doe'@'%').
Identifying what actions were taken during elevated session access reveals how persistence was created.
2
Evaluate the state of the PAM vault session termination at 14:15:00.
The PAM vault successfully terminated the break-glass session and automatically rotated the password for 'sa_db_admin'.
This confirms that the vault software functioned as designed regarding credential lifecycle management.
3
Correlate post-expiration access at 14:30:12 with the changes made in Step 1.
The user authenticated successfully using their standard personal account ('j_doe') because the database permission grant persisted independently of the vault credential status.
Without command filtering or continuous identity reconciliation (least privilege/ABAC enforcement), vault session teardowns cannot clean up out-of-band access control changes made on target resources.

Anahtar Kavram

Identity and Access Management Operations - Privileged Access Management and Lifecycle Control Governance
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity and Access Management Operations

Bu konudan daha fazla soru