Identity & Access Management Flashcards

During a threat hunt, an analyst finds that an attacker used Kerberoasting. Which indicator would appear in Defender for Identity alerts?

Answer: Abnormal Kerberos ticket request for a service account with a weak encryption type

Kerberoasting requests service tickets using RC4 encryption (downgrade), and Defender for Identity flags these abnormal TGS requests targeting service accounts.

A Conditional Access policy is set to require a compliant device for all cloud apps. A user on a non-enrolled personal phone is blocked. Which Entra ID feature would allow the user to access only approved apps on that device?

Answer: App Protection Policies (MAM without enrollment)

Mobile Application Management (MAM) without device enrollment applies data protection policies to approved apps without requiring full MDM enrollment.

Microsoft Defender for Identity raises a 'Suspected Golden Ticket usage' alert. What does this indicate about the attacker's access level?

Answer: The attacker forged a Kerberos TGT using the KRBTGT account hash

A Golden Ticket attack involves forging a TGT using the KRBTGT hash, giving the attacker persistent, domain-wide Kerberos authentication capabilities.

Which Microsoft Sentinel analytic rule would best detect impossible travel sign-ins for Entra ID users?

Answer: A rule correlating two sign-ins from geographically distant locations within a short timeframe

Impossible travel detection correlates sign-in source locations and timestamps to flag authentications that could not physically occur given travel time between locations.

An analyst needs to remediate a compromised account in Microsoft Entra ID Protection. Which combination of actions fully remediates the risk?

Answer: Reset password, revoke all sessions, and confirm user is compromised

Full remediation requires resetting credentials to evict the attacker, revoking active sessions to terminate existing access, and confirming compromise to feed the risk engine.

Which Microsoft Entra ID feature provides just-in-time privileged access with approval workflows and time-limited role assignments?

Answer: Privileged Identity Management (PIM)

PIM enables eligible users to activate privileged roles on-demand with approval workflows and enforces time-limited assignments to reduce standing privilege.

A security operations team wants to receive alerts whenever a new Global Administrator is added in their tenant. Which Microsoft Sentinel source provides this data?

Answer: Microsoft Entra ID AuditLogs via the Azure AD connector

Entra ID AuditLogs record all administrative changes including role assignments, and the Azure AD connector streams these into Sentinel for alerting.