CySA+ Test Identity and Access Management 3

Question 1

A threat actor compromises a domain controller and forges a Kerberos ticket-granting ticket (TGT) with a custom lifetime of 10 years using the KRBTGT hash. What type of attack is this?

Accepted Answer

Golden Ticket attack

Answer

A Golden Ticket attack uses the compromised KRBTGT account hash to forge valid Kerberos TGTs, granting the attacker persistent, domain-wide access that persists even after password resets.

Question 2

An attacker captures the NTLM hash of an administrator account from memory and uses it to authenticate to network services without cracking the password. What technique is being used?

Accepted Answer

Pass-the-Hash

Answer

Pass-the-Hash exploits NTLM authentication by using the stolen password hash directly for authentication without needing the plaintext password.

Question 3

Which CySA+ tool or technique would BEST help detect when a legitimate user account is exhibiting anomalous behavior such as logging in at unusual hours or accessing unusual resources?

Accepted Answer

User and Entity Behavior Analytics (UEBA)

Answer

UEBA establishes behavioral baselines for users and entities, then flags deviations such as unusual login times or abnormal data access patterns that may indicate account compromise or insider threat.

Question 4

An organization wants to enforce that its vendors can only access specific systems during business hours from approved IP addresses. Which access control model is MOST suited to enforce this policy?

Accepted Answer

Attribute-Based Access Control (ABAC)

Answer

ABAC makes access decisions based on multiple attributes — such as user identity, time of day, IP address, and resource type — making it the most flexible model for complex, context-aware policies.

Question 5

What is the primary security concern when an organization uses a shared service account with a static password for multiple automated processes?

Accepted Answer

Accountability is lost and the password may never be rotated, increasing risk of undetected compromise

Answer

Shared service accounts lack individual accountability, and static passwords are rarely rotated, creating long windows of exposure if the credential is compromised without detection.

CySA+ Practice Test Practice Test

CySA+ Practice Test Practice Test

CySA+ Test Identity and Access Management 3