mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation with a hybrid cloud…
A multinational corporation with a hybrid cloud infrastructure has recently experienced a series of security incidents involving unauthorized access to sensitive customer data. The incidents were traced to compromised credentials of privileged users. The company has implemented multi-factor authentication (MFA) for all privileged accounts, but the attacks persisted. A security assessment team is brought in to evaluate the environment. During the assessment, they discover that some privileged accounts do not require MFA when accessing systems via API calls, and that session tokens for these APIs have a long expiration time of 24 hours. Additionally, the team finds that the logging and monitoring system does not capture API calls from privileged accounts, making it difficult to detect anomalous behavior. The company wants to remediate these issues effectively. Which of the following is the BEST course of action to address the root cause of the incidents?
⚠ Common exam trap
Many candidates choose a detective control (like SIEM) or a reactive measure (like auditing) instead of a preventive control that directly closes the authentication gap, because they overlook that the root cause is the MFA bypass on API calls and long-lived tokens, not a lack of monitoring or account hygiene.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.
The root cause is that privileged accounts can bypass MFA when accessing systems via API calls, and long-lived session tokens (24 hours) provide a wide window for attackers to reuse stolen tokens. Requiring MFA for all privileged access methods, including APIs, closes the authentication gap, and reducing session token expiration to 15 minutes minimizes the impact of token theft by limiting the reuse window. This directly addresses the two key vulnerabilities identified in the assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a SIEM system to analyze logs from all sources and create alerts for anomalous API activity.
Why it's wrong here
While a Security Information and Event Management (SIEM) system is critical for detecting anomalous activity and enabling a rapid response to security incidents, it primarily serves as a detective control. Implementing a SIEM would alert security teams *after* an unauthorized API access attempt or compromise has occurred, rather than proactively preventing the initial breach. It does not address the underlying vulnerabilities that allow the unauthorized access in the first place.
- ✗
Conduct a full audit of privileged account usage and revoke access for any accounts with suspicious activity.
Why it's wrong here
Conducting an audit of privileged account usage is a crucial corrective and detective control, identifying past or ongoing misuse and allowing for remediation. However, an audit is inherently reactive; it reviews historical data to find suspicious activity *after* it has happened. This action would not prevent a future unauthorized API access incident from occurring, as it doesn't implement proactive security measures to block initial compromise attempts.
- ✓
Require MFA for all privileged access methods, including APIs, and reduce session token expiration to 15 minutes.
Why this is correct
This option directly addresses two critical vulnerabilities in privileged access and API security. Requiring Multi-Factor Authentication (MFA) significantly enhances security by ensuring that even if an attacker compromises credentials, they cannot gain access without the second factor. Simultaneously, reducing session token expiration to 15 minutes drastically limits the window of opportunity for an attacker to exploit a stolen or compromised session token, thereby minimizing potential damage from unauthorized access.
- ✗
Replace API tokens with certificate-based authentication for all privileged accounts.
Why it's wrong here
Replacing API tokens with certificate-based authentication would indeed enhance the strength of the authentication mechanism by leveraging cryptographic identities, which are generally more secure than simple tokens. However, this change primarily improves the *method* of authentication. It does not inherently address the crucial issue of session management, specifically the duration for which an authenticated session remains valid. An attacker could still exploit a long-lived, certificate-based session if its expiration is not adequately reduced.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.