CySA+ Identity Access Monitoring Techniques

1. Which monitoring metric helps identify user accounts that have not been used for extended periods?

Last logon timestamp analysis

Bandwidth utilization trends

CPU performance metrics

Disk space allocation

2. What is the significance of correlating access logs with security events in CySA+ operations?

To identify attack chains and determine attack scope and impact

To reduce the number of backup systems

To eliminate encryption requirements

To simplify user account naming conventions

3. Which monitoring technique detects when multiple failed authentication attempts precede a successful login?

Credential stuffing or brute force attack detection

Session timeout enforcement

Certificate pinning validation

Encryption algorithm verification

4. What is the role of account provisioning and deprovisioning logs in access monitoring?

To track when accounts are created, modified, or removed to detect unauthorized changes

To measure employee productivity levels

To optimize network routing protocols

To monitor printer status and supply levels

5. Which security operations metric tracks the time between detecting a suspicious access event and responding to it?

Mean Time to Respond (MTTR)

Mean Time Between Failures (MTBF)

Maximum Transmission Unit (MTU)

Message Transfer Rate (MTR)

6. What does access entitlement monitoring verify in identity governance?

That users only retain permissions appropriate to their current role

That all passwords meet complexity requirements

That firewall rules are properly ordered

That encryption keys are rotated annually

7. Which monitoring approach helps identify when privileged accounts are accessed from non-standard locations or devices?

Geolocation and device fingerprinting analysis

Email content filtering

Web proxy caching

DNS forwarder configuration

8. What is the primary benefit of implementing real-time identity and access alerts?

Enables rapid incident response to unauthorized access attempts

Eliminates the need for backup systems

Reduces software licensing costs

Simplifies user password resets

9. Which access monitoring technique is most effective for detecting account takeover through credential compromise?

Anomaly detection and impossible travel alerts

Firewall packet inspection

Antivirus signature scanning

Network bandwidth throttling

10. What does behavioral analytics in access monitoring detect?

Deviations from a user's typical access patterns and activities

The color of a user's workstation

The number of emails sent daily

The type of operating system used

11. Which monitoring technique detects when a user account attempts login from geographically impossible locations within a short time frame?

Impossible travel detection

Brute force monitoring

Session hijacking prevention

Password spray detection

12. What is the significance of monitoring for lateral movement in identity and access security?

To detect attackers moving between systems after initial compromise

To track employee productivity

To monitor file transfer speeds

To audit backup completion times

13. Which log source is most critical for detecting privilege escalation attempts?

Windows Security Event Log and sudo/su command logs

Web server access logs

DNS query logs

DHCP server logs

14. What does the principle of least privilege monitoring ensure in access control auditing?

Users have only the minimum permissions required for their role

All users receive administrative access

Passwords are changed monthly

Multi-factor authentication is optional

15. Which authentication log analysis technique helps identify compromised credentials through repeated failed logins followed by success?

Failed-to-successful login pattern analysis

Token expiration monitoring

Certificate chain validation

Encryption strength verification

16. What is session monitoring primarily designed to detect?

Unauthorized access, session hijacking, and anomalous user behavior

Email spam and phishing attempts

Network bandwidth overuse

Printer configuration changes

17. Which monitoring indicator suggests that a service account may have been compromised?

Unexpected access outside normal business hours

Regular scheduled maintenance tasks

Routine backup operations

Scheduled report generation

18. What does SIEM stand for in the context of identity and access monitoring?

Security Information and Event Management

Secure Identity Enforcement Module

System Integrity and Endpoint Monitoring

Sensitive Information Exchange Management

19. Which tool or technique provides real-time visibility into user access and privilege usage across enterprise systems?

Privileged Access Management (PAM)

Email filtering systems

DNS blocking services

Firewall rule sets

20. What is the primary purpose of monitoring failed authentication attempts in security operations?

To identify potential brute force or credential stuffing attacks

To reduce user password complexity requirements

To eliminate multi-factor authentication

To simplify network access logs

CySA+ Identity and Access Monitoring Techniques Quiz