Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

An incident response team is reviewing operational logs from an enterprise Privileged Access Management (PAM) system after an emergency database restoration. The following audit log snippet was recorded during the incident:

[11:02:15] PAM_VAULT: Account 'bg_admin01' checked out by user 'j.doe'. Reason: INC-9904.
[11:02:16] PAM_VAULT: Temporary credentials issued; rotate-on-checkin timer active (4 hours).
[11:02:20] PAM_PROXY: SSH session initiated to target 'db-prod-01' by 'bg_admin01'. Live session recording enabled.
[11:45:10] PAM_VAULT: Account 'bg_admin01' manually checked back in by user 'j.doe'.

Based on identity and access management operational standards, which automated action should the PAM solution perform immediately upon account check-in?

  1. Rotate the credential password and terminate any active sessions associated with the checked-in account.Answer
  2. B
    Permanently grant the primary user account administrative authorization rights across all production databases.
  3. C
    Deploy a corrective host firewall rule to block all incoming SSH traffic on the target database server.
  4. D
    Generate an anomalous credential harvesting alert because the checkout duration was less than one hour.

Answer

The PAM solution should immediately rotate the account password and invalidate any active sessions tied to the break-glass account upon check-in.
Privileged Access Management (PAM) systems use password vaulting and checked-out credential management to secure administrative access. When a user manually checks in a break-glass or shared administrative account, the PAM software immediately rotates the password in the target environment and revokes active proxy connections. This ensures the credentials used during the session cannot be reused.

Step-by-Step Solution

1
Analyze the log entries for account lifecycle events.
Identified that user 'j.doe' checked out emergency break-glass account 'bg_admin01' at 11:02:15 and checked it back in at 11:45:10.
Break-glass accounts utilize temporary credentials intended only for emergency window usage.
2
Determine the security requirements of a Privileged Access Management (PAM) vault check-in workflow.
Upon check-in, the PAM solution must ensure single-use credential integrity by invalidating the issued secret.
Automated password rotation prevents credential reuse, shoulder surfing exploits, and unauthorized persistent access.
3
Select the operational action that maintains zero-trust principle and least privilege.
The PAM system automatically rotates the password and terminates lingering proxy sessions.
This guarantees that the temporary authorization period is closed immediately upon work completion.

Key Concept

Privileged Access Management (PAM) Break-Glass Account Lifecycle & Automatic Credential Rotation
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic