Examkin

Soru

Zorluk: ZorIdentity and Access Management Operations

An IAM administrator at an online payment processor is reviewing identity operational logs after an audit revealed that a terminated contractor retained administrative access to production API gateways 48 hours after offboarding:

Timestamp (UTC)Event IDIdentity / SubjectSystem ComponentDetails / Status
2026-07-25 09:00:00EVT-801[email protected]IdP DirectoryUser account status set to Disabled
2026-07-25 09:00:05EVT-802[email protected]SCIM EngineProvisioning push failed: Integration token expired
2026-07-25 09:05:00EVT-803[email protected]API GatewayRefresh token exchange succeeded (New access token issued)
2026-07-27 08:30:00EVT-804[email protected]API GatewayAdministrative configuration change executed

Based on the log analysis, which of the following identifies the primary technical cause of the persistent access and the most effective operational fix?

  1. The automated deprovisioning sync failed due to an expired SCIM integration token, and long-lived OAuth refresh tokens were not explicitly revoked upon account disablement; implementing Continuous Access Evaluation (CAE) or automated token revocation hooks is required.Cevap
  2. B
    The central identity provider failed to properly authenticate the contractor during the session refresh attempt; reconfiguring network-level conditional access policies to require step-up MFA will prevent unauthorized API access.
  3. C
    The internal API gateway relied on perimeter network boundaries to implicitly trust active backend connections; establishing IP-based firewall filtering rules for disabled vendor accounts is required.
  4. D
    The SCIM engine failed because it was misconfigured as a detective control rather than a corrective control in the governance framework; updating the identity control classification will resolve the provisioning pipeline.

Cevap

The persistent access was caused by an expired SCIM provisioning token preventing downstream account deprovisioning combined with active OAuth refresh tokens that were not invalidated; the operational fix requires implementing Continuous Access Evaluation (CAE) or automated token revocation hooks.
The logs clearly show that while the account was disabled in the directory (EVT-801), the SCIM engine failed to propagate this disablement due to an expired integration token (EVT-802). As a result, the API Gateway honored the user's existing OAuth refresh token (EVT-803), granting continued access. Remediating this requires repairing SCIM token authentication and enforcing Continuous Access Evaluation (CAE) or automated revocation webhooks to instantly invalidate active tokens when an account status changes.

Adım Adım Çözüm

1
Analyze the log entries sequentially to trace the deprovisioning workflow failure.
Event EVT-801 shows account disablement in the primary Identity Provider at 09:00:00 UTC, but EVT-802 indicates that SCIM provisioning push failed due to an expired integration token five seconds later.
SCIM depends on valid API credentials/tokens to propagate identity lifecycle updates to relying applications.
2
Examine downstream authentication and authorization behavior following the failed SCIM push.
At 09:05:00 UTC (EVT-803), the API Gateway processed a valid OAuth refresh token request because it was never notified of the user's disabled status, issuing a new active access token.
OAuth refresh tokens remain valid until explicitly revoked or expired; disabling an account in the primary IdP does not automatically invalidate active downstream tokens without active revocation mechanisms.
3
Determine the required IAM operational remediation.
Fixing the SCIM integration credential maintenance and deploying Continuous Access Evaluation (CAE) / automated token revocation ensures real-time session invalidation across all relying parties.
CAE enables identity providers and reliance endpoints to communicate security events dynamically, stopping active sessions immediately upon account risk state changes.

Anahtar Kavram

Identity Provisioning, Lifecycle Synchronization, and Token Revocation Operations
Bu soruyu puanla

Konular

Identity and Access Management Operations

Bu konudan daha fazla soru