Group 09: Identity, Cloud, and Microsoft Security

What is authentication?

Verifying the identity of a user, device, or system.

What is authorization?

Determining what an authenticated identity is allowed to access or perform.

What is MFA?

Requiring two or more different authentication factors.

What is least privilege?

Giving users and systems only the minimum permissions required to perform their responsibilities.

What is role-based access control?

Assigning permissions according to a user’s job role.

What is a privileged account?

An account with elevated permissions capable of making significant system or security changes.

What is a service account?

An account used by an application, service, or automated process rather than a person.

What is password spraying?

Trying a small number of common passwords against many accounts to avoid lockouts.

What is credential stuffing?

Using credentials stolen from one service to attempt access to other services.

What is MFA fatigue?

Repeatedly sending MFA requests in an attempt to pressure a user into approving one.

What is session hijacking?

Taking control of an authenticated session, commonly by stealing a session token or cookie.

What is token theft?

Stealing an authentication or access token to impersonate a user without entering the password.

What is Conditional Access?

A policy system that allows, blocks, or challenges access based on conditions such as identity, device, location, application, and risk.

What is Microsoft Entra ID?

Microsoft’s cloud identity and access-management service, formerly called Azure Active Directory.

What information is found in Entra ID sign-in logs?

User, application, source IP, location, device, authentication method, MFA result, Conditional Access result, and sign-in status.

What information is found in Entra ID audit logs?

Directory and configuration changes involving users, groups, applications, roles, and policies.

What is Microsoft Defender for Endpoint?

An endpoint-security platform providing prevention, detection, investigation, vulnerability visibility, and response capabilities.

What is Microsoft Defender for Cloud?

A cloud-security platform providing security-posture management and workload protection.

What is the cloud shared-responsibility model?

The cloud provider secures the underlying infrastructure, while the customer remains responsible for areas such as identities, data, configuration, and workloads depending on the service model.

What is cloud IAM?

Policies and controls that determine which identities can perform actions on cloud resources.

What is a cloud misconfiguration?

An insecure or unintended configuration that exposes resources, identities, services, or data.

Why can activity in an unusual cloud region be suspicious?

It may indicate compromised credentials, unauthorized resource creation, or attacker evasion, although business context must be verified.

Why are cloud access keys sensitive?

They can provide programmatic access to cloud resources and may remain valid without interactive MFA.

Why should hardcoded credentials be avoided?

They may be exposed through source code, repositories, configuration files, logs, or system images.

What should be reviewed for a risky cloud sign-in?

User, IP address, location, device, application, authentication method, MFA result, Conditional Access result, session activity, and subsequent resource acces