Which IAM concept is associated with analyzing logs for suspicious activities?

• A. Use multi-factor methods to secure access.
• B. Incident Response Plan.
• C. Access Log Monitoring.
• D. Strong Authentication.

Answer: (C)

Analyzing logs for suspicious activities is about visibility and detection of unauthorized or unusual access, which is achieved through access log monitoring. This practice involves collecting authentication and authorization events from systems, applications, and APIs, then centralizing them for review. By examining details like who logged in, when, where they came from (IP, location), what resources were accessed, and whether there were unusual patterns (e.g., spikes in failed logins, logins at odd hours, access from new devices), you can spot potentially malicious activity or policy violations. Using tools like SIEMs to correlate events across services helps trigger alerts when anomalies are detected, enabling quicker investigation and response.

This concept is distinct from using multi-factor authentication, which strengthens the login process itself but does not focus on reviewing stored events. It’s also separate from an Incident Response Plan, which outlines steps to take after a security event has been detected, and from Strong Authentication, which describes the strength of the authentication method rather than monitoring activity. Access log monitoring provides the ongoing visibility needed to detect and investigate suspicious access patterns within IAM.