Which items are typically monitored as part of an auditing and logging program in IAM?

• A. Access events, permission changes, and authentication failures.
• B. Only successful logins, ignoring failures.
• C. CPU temperature of servers.
• D. License expenditure reports only.

Answer: (A)

Auditing and logging in IAM focuses on capturing events that show who is doing what, when, and with what level of access, so the system can detect misuse or misconfigurations and support investigations. The best practices include monitoring access events, permission changes, and authentication failures.

Access events reveal which identities interacted with which resources, when the interaction occurred, and under what context. This helps you reconstruct activity trails and verify that access aligns with policy and the principle of least privilege. Tracking permission changes is crucial because modifications to roles, groups, or policies can indicate privilege escalation or accidental drift from the desired security posture. Keeping an eye on authentication failures is essential because repeated or unusual failures can signal brute-force attempts, compromised credentials, or targeted phishing campaigns.

Other options don’t align as directly with IAM auditing. Focusing only on successful logins ignores the important signals provided by failed attempts, which can reveal security threats. Monitoring CPU temperature relates to infrastructure health, not identity and access events. License expenditure reports are about cost and asset management, not the security and governance of who can access what.