Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

An organization is updating its enterprise Identity and Access Management (IAM) architecture to reduce credential exposure and prevent lateral movement across server environments. The security architect needs to eliminate static, long-lived administrator credentials and ensure that elevated privileges are granted only on-demand for specific tasks and automatically revoked upon task completion. Which of the following IAM architectural strategies best fulfills this requirement?

  1. Implementing Privileged Access Management (PAM) integrated with Just-In-Time (JIT) access and ephemeral credential provisioning.Cevap
  2. B
    Mandating multi-factor authentication (MFA) for all domain administrator logins across internal network segments.
  3. C
    Restricting administrative interactive sessions to dedicated jump hosts located within a secured management VLAN.
  4. D
    Enforcing static role-based access control (RBAC) directory groups for administrator privilege assignment.

Cevap

Implementing Privileged Access Management (PAM) integrated with Just-In-Time (JIT) access and ephemeral credential provisioning.
The solution advocating Privileged Access Management (PAM) with Just-In-Time (JIT) access and ephemeral credential provisioning directly meets the objective. JIT access eliminates standing privileges by generating temporary, scoped credentials or elevating access rights strictly during an approved session window and revoking them automatically afterward.

Adım Adım Çözüm

1
Analyze the core architectural requirement described in the enterprise scenario.
The requirement calls for eliminating static, long-lived administrator credentials and replacing them with temporary privilege elevation that expires automatically upon completion of administrative tasks.
Persistent high-privilege credentials present a high-value target for attackers attempting lateral movement.
2
Evaluate candidate IAM mechanisms against the requirement of dynamic, temporary elevation.
Privileged Access Management (PAM) solutions supporting Just-In-Time (JIT) access issue short-lived or ephemeral credentials specifically for authorized workflows and revoke them immediately after the designated window.
JIT access reduces standing privilege attack surface to zero when no administrative task is active.
3
Distinguish PAM JIT solutions from static authentication or network isolation controls.
Controls like MFA, jump hosts, or static RBAC directory groups enhance security but leave permanent privileged memberships intact.
Only PAM with JIT access specifically addresses the lifecycle and ephemeral nature of administrator privilege elevation.

Anahtar Kavram

Privileged Access Management (PAM) and Just-In-Time (JIT) Access Architecture
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru