Objective 4.6: Given a scenario, implement and maintain identity and access management
Security+ SY0-701 practice question
An audit of a company's privileged access finds two problems. First, eight administrators hold permanent domain administrator rights even though each one needs those rights for only a few hours a month, at unpredictable times such as during outages. Second, the shared local administrator password for the server fleet has not changed in two years and is kept in a spreadsheet. Which TWO privileged access management capabilities would BEST address these findings?
- Single sign-on
Single sign-on lets users authenticate once to reach many applications. It improves convenience, but it neither removes standing administrator rights nor protects or rotates a shared local password.
- Just-in-time permissions(Correct)
Correct. Just-in-time permissions grant domain administrator rights only for the approved time an administrator needs them, so the eight accounts no longer hold those rights permanently.
- Time-of-day restrictions
Time-of-day restrictions limit when an account can sign in, but the administrators would still hold full domain administrator rights during every allowed window. That shortens the exposure without removing standing privilege, and the rights are needed at unpredictable times anyway.
- Federation with a partner identity provider
Federation lets users from one organization authenticate to another organization's services through a trusted identity provider. It does not address internal standing privilege or a stale shared password.
- Password vaulting with automatic rotation(Correct)
Correct. Vaulting moves the shared password out of the spreadsheet into a protected, audited store, and automatic rotation changes it regularly (or after each use), so a leaked copy quickly becomes useless.
- Discretionary access control
Discretionary access control is an access control model in which resource owners decide who gets access. It does nothing to time-limit administrator rights or to protect and rotate credentials.
Explanation
Privileged access management (PAM) reduces the risk of powerful accounts. Just-in-time permissions remove standing privilege: administrators request elevated rights when they need them, for a limited time, and the rights are removed automatically afterward. Password vaulting stores privileged credentials in a secured, audited vault, checks them out to approved users, and rotates them automatically so that shared passwords do not stay valid for years.