Examkin

Question

Difficulty: HardIdentity and Access Management Operations

A security operations analyst is investigating an unauthorized privilege escalation incident on a critical Linux database server. A database administrator checked out temporary, just-in-time (JIT) root access through the enterprise Privileged Access Management (PAM) vault to conduct routine maintenance. Reviewing the target server's local `/var/log/secure` logs alongside the PAM gateway logs reveals the following entries:

[PAM Gateway] 14:02:11 UTC - JIT Session #8942 initiated for User 'db_admin_01' -> Target: db01.corp.internal (SSH proxy port 2222)
[PAM Gateway] 14:02:12 UTC - MFA Challenge SUCCESS (FIDO2 Security Key)
[Target syslog] 14:02:12 UTC - sshd[4102]: Accepted publickey for db_admin_01 from 10.200.15.5 (PAM Proxy) port 48110 ssh2
[Target syslog] 14:15:33 UTC - sshd[4891]: Accepted password for db_admin_01 from 10.200.45.118 (Dev Subnet) port 51204 ssh2
[Target syslog] 14:15:40 UTC - sudo[4910]: db_admin_01 : TTY=pts/2 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/chmod +s /bin/bash

Which of the following operational root causes BEST explains why the unauthorized secondary SSH session from 10.200.45.118 was established without going through the PAM gateway's MFA controls?

  1. The local server retained static administrative credentials, allowing direct SSH authentication from unapproved source IPs bypassing proxy-enforced PAM workflow.Answer
  2. B
    The perimeter firewall failed to perform continuous Layer 3 inspection to block non-proxy traffic originating from internal subnets.
  3. C
    The central Active Directory domain controller failed to authorize the role-based access control (RBAC) group policy update during the active JIT window.
  4. D
    The SIEM log ingestion engine failed to automatically correlate the timestamp offset between the PAM proxy and the target host syslog daemon.

Answer

The target server retained static local administrative credentials, allowing direct SSH password authentication from unapproved IP addresses outside the PAM proxy pathway.
The root cause is that local password authentication remained active and configured with static credentials on the target host. Effective PAM deployments require that direct administrative access routes be locked down so that connections can ONLY originate from the PAM proxy using dynamically rotated or vault-managed credentials. Because static password login remained enabled, an actor possessing the password connected directly from an internal subnet (10.200.45.118), completely bypassing the PAM proxy and its enforced MFA controls.

Step-by-Step Solution

1
Analyze the log entries from the PAM gateway and target server.
The legitimate session at 14:02:12 UTC connected via the PAM Proxy (10.200.15.5) using public key authentication after FIDO2 MFA. The second session at 14:15:33 UTC connected directly from a developer workstation (10.200.45.118) using password authentication.
Tracing origin IPs and authentication methods reveals how the second connection bypassed the gateway.
2
Evaluate why the PAM vault proxy was bypassed.
PAM solutions enforce MFA and session recording by acting as an inline proxy. If target systems allow direct SSH access via static password credentials rather than restricting access strictly to short-lived SSH keys or proxy IPs, attackers can connect directly.
Identifying the operational flaw in credential management explains the security control failure.
3
Determine the necessary operational remediation.
Disable static local passwords, enforce SSH host key trust strictly with the PAM proxy, or utilize local account password vaulting/rotation to eliminate direct static logins.
Direct authentication paths must be remediated to ensure all administrative access routes through the PAM solution.

Key Concept

Privileged Access Management (PAM) Operational Hardening and Session Interception
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic