Privileged Access Flashcards
7 cards from real CIAM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privileged Access flashcards as text
What is a 'break-glass' account in PAM, and when is it used?
Answer: An emergency account with high privileges used only when normal admin access is unavailable
Break-glass accounts provide emergency access during system outages or lockouts and are tightly monitored because their use signals an exceptional event.
Which PAM metric best indicates whether the principle of least privilege is being enforced across an organization?
Answer: Percentage of users with admin rights relative to total user population
A low ratio of privileged users to total users indicates least privilege is being enforced; a high ratio suggests over-provisioning.
Which cloud-native feature in AWS allows services to assume a role with temporary credentials instead of using long-term access keys?
Answer: IAM roles with STS
AWS IAM roles combined with the Security Token Service (STS) provide temporary, automatically rotated credentials, eliminating long-term static keys.
When evaluating a PAM vendor, which capability ensures that privileged credentials are rotated immediately after each use?
Answer: One-time password (OTP) for privileged accounts
OTP-based privileged access generates a unique password for each session, invalidating it immediately after the session ends.
A red team finds that a developer's workstation stores SSH private keys in plaintext, providing root access to production. Which PAM gap does this expose?
Answer: Unmanaged privileged credentials outside the vault
Unmanaged SSH keys stored outside a PAM vault represent ungoverned privileged credentials that bypass all vault controls and audit trails.
Which IAM governance activity should an organization perform quarterly to ensure privileged access remains appropriate?
Answer: Access certification (recertification) campaign
Quarterly access certification campaigns require managers to formally review and approve or revoke each employee's privileged access rights.
What does 'ephemeral credentials' mean in the context of cloud privileged access?
Answer: Short-lived, automatically expiring secrets generated on demand
Ephemeral credentials are temporary secrets with a short TTL, drastically reducing the risk window if they are compromised.