Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security engineer at an e-commerce organization is investigating an alert indicating anomalous privileged activity on a production database cluster. The authentication and operational log snippet shows:

ParameterLog Entry Details
Timestamp2026-07-27T14:22:10Z
Accountadmin_jsmith
Source IP198.51.100.45 (External WAN)
AuthenticationRADIUS with MFA (Success)
Executed ActionGRANT ALL PRIVILEGES ON customer_db TO temp_user;
Matched PolicyDefault_Admin_Role

The organization's security policy mandates that all privileged administrative sessions on critical systems must be brokered exclusively through a Privileged Access Management (PAM) jump host with short-lived session checkout. Which of the following is the MOST effective operational control modification to prevent direct administrative command execution outside the PAM solution?

  1. Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.Answer
  2. B
    Implement step-up multi-factor authentication to prompt the administrator for a secondary token prior to executing database privilege elevation statements.
  3. C
    Relocate the database cluster inside the internal corporate network perimeter and permit administrative commands originating from internal subnets.
  4. D
    Configure the Security Information and Event Management (SIEM) system to generate high-priority incident tickets for external administrative logins.

Answer

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.
Enforcing network access control lists (ACLs) and restricting authorization rules so that administrative access is accepted only from designated PAM jump host IP addresses provides a preventive control. This ensures all privileged sessions are brokered, recorded, and managed according to enterprise IAM operational policy.

Step-by-Step Solution

1
Analyze the log entries and identify the security policy violation.
The log shows a direct RADIUS-authenticated session executing privileged database commands from an external WAN IP address, bypassing the required PAM jump host.
Privileged access management policies require all administrative sessions to be brokered, audited, and isolated through a dedicated PAM proxy or jump server.
2
Evaluate the required security control type to eliminate direct access bypass.
Enforcing network-level Access Control Lists (ACLs) and authorization policies at the database listener layer ensures that only connections originating from the PAM jump host IP address are accepted for administrative accounts.
Preventive network and authorization controls stop unauthorized direct connections before session establishment occurs.

Key Concept

Privileged Access Management (PAM) Session Brokering & Enforcement
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic