Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security analyst is investigating an authentication and privileges alert in a hybrid enterprise environment. The log audit reveals that a non-interactive service account (`svc_vaultsync`) authenticated via LDAPS from a workstation IP address and successfully retrieved domain administrative credentials from a Privileged Access Management (PAM) vault outside scheduled maintenance hours. Which of the following operational controls or administrative practices should the security team implement to mitigate this incident and harden IAM operations against future abuse? (Select TWO.)

  1. Configure service accounts to use Group Managed Service Accounts (gMSAs) with auto-rotating passwords and disable interactive shell login capabilities.Answer
  2. B
    Trust all internal network traffic originating from authorized workstation subnet IP addresses without performing continuous access evaluation.
  3. Enforce Just-In-Time (JIT) access workflows requiring approval before PAM vault administrative credentials can be checked out.Answer
  4. D
    Automatically grant administrative authorization permissions whenever LDAP authentication succeeds without verifying role-based access limits.

Answer

The correct operational measures are configuring Group Managed Service Accounts (gMSAs) with disabled interactive logins, and enforcing Just-In-Time (JIT) PAM checkout approval workflows.
Configuring Group Managed Service Accounts (gMSAs) with automatic password management and non-interactive privileges prevents manual checkout or misuse of service account credentials. Enforcing Just-In-Time (JIT) access requiring explicit approvals ensures privileged credentials cannot be retrieved from a PAM vault without prior authorization.

Step-by-Step Solution

1
Analyze the incident details from the log audit.
Identified that a service account was used interactively outside maintenance windows to check out domain admin credentials from a PAM vault.
Determining how the service account was abused identifies the weakness in account lifecycle management and PAM checkout rules.
2
Evaluate identity lifecycle and service account security controls.
Converting service accounts to gMSAs removes password exposure and prevents interactive logon capabilities.
Service accounts should be non-interactive and managed dynamically by Active Directory to eliminate static credential theft.
3
Evaluate Privileged Access Management (PAM) operational controls.
Requiring Just-In-Time (JIT) approval workflows prevents unauthorized credential checkout outside approved change windows.
JIT access ensures elevated credentials are only provisioned temporarily and upon explicit manager/peer authorization.

Key Concept

Privileged Account Lifecycle and Just-In-Time Access Management
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic