Cybersecurity Analyst
Identity security questions
177 questions on Identity security for cybersecurity analysts, easiest first.
Easy 50
- Which login is really two-factor?easy
- Why passwords are saltedeasy
- Brute force or password spraying?easy
- A user added to Domain Adminseasy
- Authentication or authorization?easy
- What a Kerberos TGT is foreasy
- Where the Kerberos KDC runseasy
- Windows event for a failed logoneasy
- Event for a locked-out accounteasy
- Event for a new user accounteasy
- What LAPS solveseasy
- Accounts of staff who lefteasy
- File that holds every domain hasheasy
- What credential stuffing iseasy
- Why staff should use a password managereasy
- Problem with a shared admin logineasy
- Separation of duties in paymentseasy
- Admin rights on a daily accounteasy
- Rights that pile up after job moveseasy
- Weak spot of SMS one-time codeseasy
- What to do with recovery codeseasy
- Planning for a lost security keyeasy
- Where your fingerprint goeseasy
- What a Conditional Access policy iseasy
- Security defaults for a small tenanteasy
- Defining the office as a locationeasy
- Trade-off of single sign-oneasy
- Why SSPR asks for registered methodseasy
- Why use a managed identityeasy
- Database password in a Git repoeasy
- Protecting the AWS root usereasy
- Why run access reviewseasy
- Giving a partner access in Entra IDeasy
- Who made someone a Global Admin?easy
- Should the login form allow paste?easy
- Security questions for account recoveryeasy
- Who signs a SAML assertion?easy
- What SCIM provisioning doeseasy
- Allow in one policy, deny in anothereasy
- Event for a failed Kerberos pre-autheasy
- Giving 40 engineers AWS accesseasy
- Access key unused for 200 dayseasy
- Which token should the API accept?easy
- Where leaver events should come fromeasy
- Security log was wipedeasy
- Helpdesk that serves one brancheasy
- Print Spooler on domain controllerseasy
- What IAM Access Analyzer reportseasy
- Default Kerberos ticket lifetimeeasy
- Is this multi-factor?easy
Medium 68
- KQL for failed Entra sign-insmedium
- Triage an impossible travel alertmedium
- Stopping MFA fatigue attacksmedium
- Containing a hijacked Microsoft 365 accountmedium
- nltest /domain_trustsmedium
- AdFind run on a workstationmedium
- Kerberos fails after a clock driftmedium
- What a Service Principal Name doesmedium
- Connecting by IP instead of namemedium
- How pass-the-hash worksmedium
- Reusing a stolen Kerberos ticketmedium
- What the Protected Users group changesmedium
- The core rule of tiered administrationmedium
- Why admins use a separate PAWmedium
- What Credential Guard protectsmedium
- Reading logon type 10medium
- Many type 3 logons from one PCmedium
- What event 4672 tells youmedium
- Alert on new Domain Adminsmedium
- What BloodHound shows defendersmedium
- Why use a gMSA for servicesmedium
- Applying a stricter password policymedium
- Forced 60-day password changesmedium
- Longer lowercase or shorter complex?medium
- Only 3 Domain Admins on papermedium
- Setting the lockout threshold to 3medium
- How authenticator app codes are mademedium
- Why passkeys resist phishingmedium
- Is a Windows Hello PIN weaker than a password?medium
- Onboarding a new joiner passwordlessmedium
- Caller asks the helpdesk to reset MFAmedium
- Testing a new blocking policymedium
- Designing emergency access accountsmedium
- Why use Privileged Identity Managementmedium
- How many Global Admins?medium
- Sign-in risk or user risk?medium
- Where token reuse shows upmedium
- Blocking access from personal laptopsmedium
- How often to ask users to sign inmedium
- Cloud sign-in during an on-prem outagemedium
- Leaked credentials detection is silentmedium
- Users consenting to any appmedium
- Odds of guessing a 6-digit codemedium
- Stopping passwords like RedSag@2026medium
- Secret or certificate for an app registrationmedium
- Protecting MFA registration itselfmedium
- Reading 4625 sub-status codesmedium
- Finding who still uses NTLMmedium
- What logon type 9 meansmedium
- LAPS password after a helpdesk visitmedium
- Who can read a gMSA passwordmedium
- PIM settings for Global Adminmedium
- Step-up MFA for one SharePoint sitemedium
- Partners asked for MFA twicemedium
- SAML signing certificate expires soonmedium
- Wildcard redirect URI on an appmedium
- Sign-in flow for a mobile appmedium
- Leaver still signs in to a SaaS appmedium
- Admin blocked by an SCPmedium
- Assuming a role in another accountmedium
- What Allow with NotAction grantsmedium
- Restricting a bucket to your organizationmedium
- Guest reviews that nobody answersmedium
- Using a decoy admin accountmedium
- Five random words or nine characters?medium
- Minimum length for a password-only loginmedium
- Attacker still in after a resetmedium
- Endless MFA push promptsmedium
Hard 59
- Detecting Kerberoastinghard
- Evicting a Golden Ticket attackerhard
- Detecting DCSynchard
- Password reset did not stop the attackerhard
- Phishing that bypasses MFAhard
- Successful sign-in with no MFAhard
- Detecting AS-REP roastinghard
- Hardening against NTLM relayhard
- ntdsutil creating an IFM copyhard
- Why a silver ticket is hard to seehard
- Risk of unconstrained delegationhard
- Resource-based delegation abusehard
- A removed permission keeps coming backhard
- Passwords found in SYSVOL XMLhard
- Service breaks after forcing AEShard
- ntdsutil run on a domain controllerhard
- Admin rights through SID historyhard
- Why the forest is the boundaryhard
- A dangerous certificate templatehard
- Access that outlives a password resethard
- Shadow credentials on an accounthard
- Is Backup Operators privileged?hard
- Stale-account report looks wronghard
- How long to crack an 8-character hashhard
- Making admins use phishing-resistant MFAhard
- Synced or device-bound passkeys?hard
- Disabling a user who still has a tokenhard
- Stolen refresh token from an infostealerhard
- What the Primary Refresh Token ishard
- Closing the device code phishing routehard
- Forged SAML tokens bypass MFAhard
- Where to place the Entra Connect serverhard
- Why cloud admins should not be syncedhard
- Global Admin and Azure subscriptionshard
- A dynamic group that anyone can joinhard
- Smart lockout with on-prem ADhard
- MFA policy that misses service principalshard
- The AZUREADSSOACC computer accounthard
- New MFA method right after a risky loginhard
- Preparing to enforce LDAP signinghard
- Why role-assignable groups existhard
- Who controls the CA exclusion group?hard
- SP that ignores the Audiencehard
- Effect of a permissions boundaryhard
- Risk of PassRole on all roleshard
- MFA deny that access keys bypasshard
- GitHub OIDC role without a sub checkhard
- Ordinary user owns a privileged apphard
- Graph permission that equals Global Adminhard
- Invoice bot needs one mailboxhard
- Keeping Tier 0 logons on Tier 0 hostshard
- Spraying slower than the lockouthard
- Access key created for someone elsehard
- Rebuilding trust in Active Directoryhard
- Phish that needs no passwordhard
- A code to enter at microsoft.com/deviceloginhard
- Login from a new country, no MFA prompthard
- Caller asks helpdesk to reset MFAhard
- OTPs going to the attackerhard