Examkin

Soru

Zorluk: OrtaIdentity and Access Management Operations

A security operations engineer is responding to an incident where an attacker maintained access to enterprise cloud resources after an employee reported a compromised password. The security analyst immediately performed a password reset, but log reviews show the attacker continued performing administrative actions using an active Single Sign-On (SSO) session and active refresh tokens for several hours afterward. Which of the following operations should the security team perform to remediate this vulnerability and ensure immediate containment during credential resets?

  1. Enforce automated active session revocation and token invalidation workflows upon password resets.Cevap
  2. B
    Reconfigure Role-Based Access Control (RBAC) definitions to remove administrative privileges from the affected user account.
  3. C
    Restrict authentication requests exclusively to corporate perimeter IP ranges using network firewalls.
  4. D
    Reclassify identity audit logging controls from detective controls to preventive controls within the security framework.

Cevap

Enforcing automated active session revocation and token invalidation workflows upon password resets.
When a password reset occurs, modern SSO identity providers must explicitly revoke issued session tokens and refresh tokens (such as OAuth tokens or SAML session keys). Without explicit token revocation, active sessions remain valid until their scheduled time-to-live (TTL) expires, allowing unauthorized access to persist.

Adım Adım Çözüm

1
Analyze the incident evidence to determine how persistent access occurred.
Identified that password resetting alone left existing JSON Web Tokens (JWTs) and active SSO session cookies valid until their natural expiration.
Authentication protocols (OAuth 2.0/OIDC/SAML) decouple credential verification from session token lifecycles unless explicit revocation signals are sent.
2
Evaluate identity operational controls to force session termination across connected applications.
Automating session revocation invalidates all issued access and refresh tokens immediately upon credential change.
This prevents malicious actors from continuing to use cached identity tokens after authentication credentials are rotated.

Anahtar Kavram

Identity and Access Management Operations - Session Lifecycle and Token Revocation
Bu soruyu puanla

Konular

Identity and Access Management Operations

Bu konudan daha fazla soru