Which of the following is a common security event to capture to monitor authorization controls in an application?

• A. Authorization failure
• B. Password reset requests
• C. Account creation time
• D. Account deletion events

Answer: (A)

Monitoring authorization controls hinges on capturing events that reveal how access decisions are made and whether they are permitted. Authorization failure stands out because it directly shows an attempt to perform an action without the necessary permissions. Logging these failures helps you spot misconfigurations, overly broad privileges, or attempted unauthorized access, which is exactly what you want to detect when guarding access to resources.

Password reset requests relate to authentication processes and identity verification rather than what a user is permitted to do after being authenticated. Account creation time and account deletion events track lifecycle changes, which are important for auditing, but they don’t reveal how access decisions were enforced in real-time.