Which of the following scenarios represents a security risk that CrowdStrike Identity Analyzer (CIEM) is designed to identify and address?

CrowdStrike Identity Analyzer is a Cloud Infrastructure Entitlement Management (CIEM) solution. Its primary function is to discover and manage permissions for all identities (both human and non-human) within a cloud environment. The core risk it addresses is the accumulation of excessive, unused, or high-risk permissions, which can lead to privilege escalation or a wide blast radius if an identity is compromised. An IAM role with permissions to delete all cloud resources, assigned to multiple non-human identities, is a textbook example of an over-privileged identity risk that CIEM is specifically designed to identify and help remediate by enforcing the principle of least privilege.

A. This describes a network security rule. While potentially a risk, it is a configuration issue addressed by Cloud Security Posture Management (CSPM), not CIEM, which focuses on identity entitlements.
B. This is a performance and operational setting for a serverless function. It does not represent an identity-based security risk that a CIEM tool is designed to detect.
D. This scenario describes a secure, intended operation where an authorized entity accesses an encrypted resource. It represents a desired security posture, not a risk to be flagged.

1. CrowdStrike Official Documentation, "What is Cloud Infrastructure Entitlement Management (CIEM)?": "CIEM solutions continuously monitor cloud environments to identify and remediate excessive permissions and enforce the principle of least privilege (PoLP) for both human and machine identities." This directly supports the identification of over-privileged roles as a core function. (Source: CrowdStrike Website, "What is CIEM?" section).

2. CrowdStrike Official Documentation, "Cloud Identity and Entitlement Management (CIEM)" Product Page: The solution is described as being able to "Discover all human and machine identities and their permissions" and "Eliminate excessive permissions to reduce the attack surface." The scenario in option C is a prime example of excessive permissions assigned to machine (non-human) identities. (Source: CrowdStrike Website, Product section for CIEM).

3. CrowdStrike Falcon Cloud Security Solution Brief: This document outlines the capabilities of the platform, including the CIEM module's role in providing "full visibility into which identities have what permissions to which resources" and identifying "identity-based risks like dormant, stale, and over-privileged identities." The scenario in option C falls directly under the category of "over-privileged identities." (Source: CrowdStrike Falcon Cloud Security Solution Brief, CIEM capability description).