In the context of using CrowdStrike Cloud Infrastructure Entitlement Manager (CIEM) to manage identity security, which action should you take to identify inactive users across your cloud environment?

Question

Options

• ADisable all users who have not logged in for the past 30 days automatically.
• BUse CIEM to assign new roles to all users flagged as inactive.
• CPerform a manual audit of all user activity logs using CrowdStrike Falcon.
• DLeverage CIEM's Identity Analyzer to generate a report on activity patterns and detect inactivity.

• A
  10% (5)
• B
  2% (1)
• C
  4% (2)
• D
  83% (40)

Explanation

Option A: Automatically disabling users without a thorough analysis could lead to operational disruptions. CIEM performs a comprehensive assessment, considering factors like API activity, to ensure accurate detection of inactivity. Option B: Reassigning roles without first verifying the user's purpose or activity may increase security risks. CIEM focuses on identifying and managing inactive users, not on role reassignment as a default action. Option C: While CrowdStrike Falcon excels at endpoint detection and response (EDR), it is not designed for analyzing cloud identity and access management (IAM) activities. Relying on Falcon for such tasks is both inefficient and ineffective compared to using CIEM. Option D: CIEM's Identity Analyzer is specifically designed to monitor and analyze user activity patterns across cloud environments. It can automatically detect inactive users based on their login, API activity, and resource usage. This capability reduces the risk of overprivileged or orphaned accounts. Using CIEM ensures efficiency and eliminates the manual overhead of user

No community discussion yet for this question.