6.3 Given a scenario, troubleshoot security issues.

Issues

Cipher suite deprecations

Old clients fail after weak ciphers or TLS versions are disabled. Upgrade clients rather than re-enabling weak crypto.

Authorization issues

Users or services get 403 errors or, worse, more access than intended.

Privilege escalation

An identity gains higher permissions than intended, e.g. through a role that can edit its own policies.

Unauthorized access

Access by identities that should have none, found through audit logs or alerts.

Authentication issues

Sign-in failures from expired credentials, MFA problems, federation misconfiguration or clock skew.

Leaked credentials

Keys exposed in code, logs or public repos. Revoke and rotate immediately, then review what they were used for.

Software vulnerability issues

Exploitable flaws in deployed software; patch, rebuild or compensate.

Unauthorized software

Unapproved applications or images running in the environment; detect with inventory and enforce with allow lists and admission control.