QuestionQ100

Security Engineering

A security architect is addressing a vulnerability that previously resulted in a web-application data breach. A root-cause analysis identifies the following:

  • An administrator's account was hijacked and used across several Autonomous System Numbers within 30 minutes.
  • All administrators use named accounts that require multifactor authentication.
  • Single sign-on is used for every company application.

Which action should the security architect take to mitigate the issue?

  • A Configure token theft detections on the single sign-on system with automatic account lockouts.
  • B Enable context-based authentication when network locations are changed on administrator accounts.
  • C Decentralize administrator accounts and force unique passwords for each application.
  • D Enforce biometric authentication requirements for the administrator's named accounts.
Explanation

Context-based authentication evaluates signals such as network location during sign-in and can require additional authentication or block access when those signals change unexpectedly. Use of an administrator account across multiple ASNs in a short period is an anomalous network-context change that this control is designed to mitigate.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!