Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security operations team is reviewing identity and access management controls after an internal audit revealed two major vulnerabilities: third-party contractor sessions remain active for 24 hours without re-validation, and administrative users are executing high-risk privilege escalations from non-standard locations without step-up authentication. Which of the following IAM operational solutions should the security team implement to remediate these specific findings? (Select TWO.)

  1. Implement Conditional Access policies with Continuous Access Evaluation (CAE) to re-evaluate session risk and enforce real-time revocation.Answer
  2. Deploy a Privileged Access Management (PAM) solution enforcing Just-in-Time (JIT) access elevation and time-bound session limits for administrative functions.Answer
  3. C
    Configure an internal IP address allowlist on the network perimeter firewall to grant trusted SSO access to all internal network segments.
  4. D
    Replace the identity provider authentication mechanism with a local authorization database on each target server.

Answer

The security team should implement Conditional Access policies with Continuous Access Evaluation (CAE) and deploy a Privileged Access Management (PAM) solution enforcing Just-in-Time (JIT) access.
Implementing Conditional Access with Continuous Access Evaluation (CAE) directly addresses long-lived session risks by continuously evaluating context (such as location and device compliance) during active sessions. Deploying Privileged Access Management (PAM) with Just-in-Time (JIT) access restricts standing administrative privileges by granting temporary, elevated permissions only when needed.

Step-by-Step Solution

1
Analyze the identified vulnerability regarding long-lived active sessions across third-party contractor accounts.
Identify that traditional static token expiration times fail to account for mid-session risk changes.
Conditional Access combined with Continuous Access Evaluation (CAE) allows the Identity Provider (IdP) to revoke access immediately upon risk triggers like location changes or credential termination.
2
Analyze the vulnerability regarding unmonitored privilege escalation from non-standard locations.
Identify that administrative privileges should not remain assigned persistently to user accounts.
Privileged Access Management (PAM) implementing Just-in-Time (JIT) access ensures credentials are elevated only upon approval for a limited operational window, requiring MFA or step-up verification.

Key Concept

Operational IAM lifecycle controls including Conditional Access, Continuous Access Evaluation, and Privileged Access Management (PAM) JIT access.
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic