Understanding the Security Event:
Unauthorized usersgained access from non-production to production.
IAM policies were weak, allowingbulk user creation.
Vulnerability assessments were disabled, andpatching was delayed.
Logs were unavailable, making incident response difficult.
Why Options A, D, and E areCorrect:
A (Disable bulk user creation by IAM team)# Prevents unauthorized mass user account creation, which could beexploited by attackers.
D (Routine updates for endpoints & network devices)# Patch management ensuresvulnerabilities are not left open for attackers.
E (Ensure all security/network devices send logs to SIEM)# Helps withreal-time monitoring and detection of unauthorized activities.
Why Other Options Are Incorrect:
B (180-day log retention)# While log retention is good,real-time monitoring is the priority.
C (Review application allow list daily)# Reviewing itdaily is impractical. Regular audits are better.
F (Restrict production-to-non-production traffic)# The issue isunauthorized access, not traffic routing.
Reference:
CompTIA SecurityX CAS-005 Official Study Guide:IAM, Patch Management & SIEM Logging Best Practices NIST 800-53 (AC-2, AU-12):Audit Logging & Access Control