Your organization is conducting a review of inactive cloud users identified through CrowdStrike's CIEM. Which of the following metrics would best help assess the security risk posed by inactive users?

Question

Options

• AThe time since the user's account was created in the cloud environment.
• BThe total number of users flagged as inactive over the past six months.
• CThe roles and permissions associated with inactive users.
• DThe frequency of failed login attempts for inactive users.

• A
  5% (3)
• B
  9% (5)
• C
  83% (48)
• D
  3% (2)

Explanation

Option A: The account creation date is irrelevant to identifying security risks posed by inactivity. A recently created account can still pose a high risk if it has excessive permissions or is Option B: While the number of inactive users provides a broad overview, it does not assess the specific risk each user poses. Risk assessment requires detailed insights into permissions and Option C: Inactive users with excessive permissions pose a significant security risk, as their accounts can be exploited for unauthorized access. Assessing the roles and permissions helps determine the potential damage that could occur if an inactive account is compromised. This analysis is critical for prioritizing remediation efforts, such as deactivating accounts or revoking Option D: Failed login attempts could indicate a brute-force attack, but they are not the primary metric for assessing risk due to inactivity. Instead, permissions and roles are more indicative of potential impact.

No community discussion yet for this question.