Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing an alert generated by a cloud SIEM correlation rule. The rule flagged sequential API events originating from an external IP address in an enterprise AWS CloudTrail log dump:

[
{
"eventTime": "2026-07-27T10:15:02Z",
"eventName": "ConsoleLogin",
"errorMessage": "Failed authentication",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:15:18Z",
"eventName": "ConsoleLogin",
"responseElements": {"ConsoleLogin": "Success"},
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:16:05Z",
"eventName": "AttachUserPolicy",
"errorCode": "AccessDenied",
"errorMessage": "User is not authorized to perform: iam:AttachUserPolicy",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
}
]

Based on the log snippet above, which of the following statements accurately describe the security findings from this log analysis? (Select TWO.)

  1. The user account successfully established identity authentication following an initial failed login attempt.Cevap
  2. The authenticated user encountered an authorization control failure when attempting to modify IAM permissions.Cevap
  3. C
    The AccessDenied event indicates a successful SQL injection attempt against the cloud management identity database.
  4. D
    The initial failed ConsoleLogin event represents an authorization failure rather than an authentication failure.

Cevap

The correct findings are that the user account successfully established identity authentication following an initial failed login attempt, and that the authenticated user encountered an authorization control failure when attempting to modify IAM permissions.
The log analysis reveals two distinct events: first, identity verification (authentication) succeeded on the second attempt after an initial failure; second, the user attempted an administrative action (attaching an IAM policy) that was blocked by access control policies, resulting in an authorization failure ('AccessDenied').

Adım Adım Çözüm

1
Analyze the sequential ConsoleLogin events in the log snippet.
The first log entry shows 'Failed authentication' at 10:15:02Z, while the second log entry at 10:15:18Z shows 'Success'.
This establishes that credential identity verification (authentication) was completed on the second attempt.
2
Analyze the subsequent AttachUserPolicy event at 10:16:05Z.
The API call returned errorCode 'AccessDenied' and errorMessage 'User is not authorized to perform: iam:AttachUserPolicy'.
This confirms that while the user was authenticated, their role/account lacked authorization rights to attach IAM policies.

Anahtar Kavram

Log Analysis and SIEM Correlation across AAA Boundaries
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru