CIAM Audit and Monitoring Flashcards
6 cards from real CIAM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CIAM Audit and Monitoring flashcards as text
What is the primary purpose of IAM audit logs?
Answer: Providing a record of who accessed what resources and when for security and compliance
IAM audit logs capture authentication events, access decisions, and administrative changes to support incident investigations, compliance audits, and accountability.
What does 'non-repudiation' mean in the context of IAM auditing?
Answer: Ensuring a user cannot deny having performed an authenticated action
Non-repudiation ensures that users cannot deny performing actions by providing cryptographically linked evidence tying actions to their authenticated identity.
What is a SIEM system in the context of IAM monitoring?
Answer: A Security Information and Event Management system that aggregates and correlates security logs
A SIEM aggregates security logs from multiple sources, correlates events using rules and analytics, and provides real-time alerting for potential security incidents including IAM anomalies.
What is User Behavior Analytics (UBA) in IAM?
Answer: A security capability that detects anomalous user activity patterns indicating potential compromise
UBA applies machine learning to establish baseline behavior patterns for each user and alerts when deviations occur, helping detect compromised accounts and insider threats.
What is the purpose of access certification campaigns?
Answer: Periodically verifying that users retain only appropriate access rights by having managers review and approve
Access certification campaigns periodically require managers or system owners to review and confirm that each user's access rights remain appropriate for their current role.
What is 'privileged user monitoring'?
Answer: Enhanced logging, session recording, and alerting for actions taken by administrative and privileged accounts
Privileged user monitoring implements heightened audit controls including comprehensive logging, session recording, and real-time alerting specifically for high-privilege accounts.