Cert Master

KT-IAS Credential abuse

Okta ThreatInsight flags cred-stuffing against your customer portal. FIRST technical response?

Multiple choice — select one answer

Answer choices

  1. a. Enable breached-credential detection, step-up MFA, and temporary IP rate limits on auth endpoints
  2. b. Disable customer logins globally until marketing approves a customer communication, without security or identity team coordination per policy.
  3. c. Lower password length to six characters to reduce typing errors during attacks, without security or identity team coordination per policy.
  4. d. Publish successful login counts on the status page to prove transparency, without security or identity team coordination per policy.

Architectural breakdown & explanation

Credential stuffing needs rate limits, MFA, and detection—not global lockout without analysis.

Correct answer(s): a. Enable breached-credential detection, step-up MFA, and temporary IP rate limits on auth endpoints

Exam domain: Credential abuse (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Identity & Access Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications