CySA+ Test Identity and Access Management 3

Question 1

A threat actor compromises a domain controller and forges a Kerberos ticket-granting ticket (TGT) with a custom lifetime of 10 years using the KRBTGT hash. What type of attack is this?

Accepted Answer

Golden Ticket attack

Answer

Pass-the-Hash attack

Answer

Silver Ticket attack

Answer

Kerberoasting

Question 2

An attacker captures the NTLM hash of an administrator account from memory and uses it to authenticate to network services without cracking the password. What technique is being used?

Accepted Answer

Pass-the-Hash

Answer

Credential stuffing

Answer

Kerberoasting

Answer

Token impersonation

Question 3

Which CySA+ tool or technique would BEST help detect when a legitimate user account is exhibiting anomalous behavior such as logging in at unusual hours or accessing unusual resources?

Accepted Answer

User and Entity Behavior Analytics (UEBA)

Answer

Vulnerability scanner

Answer

Network intrusion detection system (NIDS)

Answer

Static application security testing (SAST)

Question 4

An organization wants to enforce that its vendors can only access specific systems during business hours from approved IP addresses. Which access control model is MOST suited to enforce this policy?

Accepted Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 5

What is the primary security concern when an organization uses a shared service account with a static password for multiple automated processes?

Accepted Answer

Accountability is lost and the password may never be rotated, increasing risk of undetected compromise

Answer

The account will be locked out due to concurrent logins

Answer

Shared accounts cannot be enrolled in directory services

Answer

Multi-factor authentication cannot be applied to service accounts

Question 6

Which of the following BEST describes the purpose of an Identity Governance and Administration (IGA) solution?

Accepted Answer

Providing automated access request, certification, and policy enforcement across the identity lifecycle

Answer

Encrypting identity data at rest and in transit

Answer

Replacing directory services like Active Directory

Answer

Monitoring network traffic for identity-based anomalies

Question 7

During an incident investigation, an analyst finds that an attacker used a compromised service account to query the Active Directory for all Service Principal Names (SPNs) and then cracked the resulting Kerberos service tickets offline. What attack technique does this describe?

Accepted Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

Golden Ticket attack

Answer

DCSync attack