mediumMultiple ChoiceObjective-mapped
CISA Practice Question: A multinational corporation is deploying a new…
A multinational corporation is deploying a new cloud-based collaboration platform for its 5,000 employees. The platform will store sensitive project data and intellectual property. The CISO mandates that all data must be encrypted at rest and in transit, and that access must be controlled via the company's identity provider (IdP) using SAML 2.0. During a pilot with the R&D department, the security team discovers that the platform's audit logs do not record failed login attempts from the IdP. The platform vendor states that the IdP is responsible for authentication, so the platform only logs successful assertions. The CISO is concerned about the lack of visibility into brute-force attacks. The company already has a SIEM that receives logs from the IdP and other sources. What is the BEST course of action?
⚠ Common exam trap
Test-takers frequently assume the cloud platform should handle all logging, but in a SAML 2.0 federation, the IdP is the sole source of authentication event logs, and the platform only logs successful assertions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable detailed logging on the IdP for all authentication attempts and forward those logs to the SIEM for monitoring
The IdP is the authoritative source for authentication events in a SAML 2.0 federated identity model. The cloud platform only receives and logs successful SAML assertions, so it cannot log failed login attempts. Enabling detailed logging on the IdP for all authentication attempts (successes and failures) and forwarding those logs to the SIEM provides the necessary visibility into brute-force attacks without changing the platform or architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the cloud platform with one that provides built-in authentication logging
Why it's wrong here
Switching platforms is costly and may not be feasible; the IdP can provide the logs.
- ✓
Enable detailed logging on the IdP for all authentication attempts and forward those logs to the SIEM for monitoring
Why this is correct
The IdP can log failed attempts; forwarding to the SIEM provides the needed visibility.
- ✗
Configure the cloud platform to require re-authentication for every session and log all authentication events locally
Why it's wrong here
This would still rely on the platform's logging, which the vendor says cannot log failed attempts.
- ✗
Implement a stricter password policy for the IdP to reduce the risk of brute-force attacks
Why it's wrong here
While a strong password policy is good, it does not provide visibility into attacks.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.