CIAM Privileged Access 2 — Questions and Answers
Question 1: Which control specifically prevents a privileged user from reading their own audit logs within a PAM system?
- Separation of duties (Correct answer)
- Least privilege
- Need-to-know
- Dual control
Correct answer: Separation of duties
Separation of duties ensures that the person performing privileged actions is different from the person who audits those actions.
Question 2: A PAM solution records every keystroke and command executed during a privileged session. What is this capability called?
- Session recording
- Keystroke logging
- Privileged session management (Correct answer)
- Activity auditing
Correct answer: Privileged session management
Privileged session management (PSM) encompasses session recording, monitoring, and control of all privileged user activities.
Question 3: What is the primary purpose of a privileged access workstation (PAW)?
- To increase bandwidth for admin tasks
- To provide a hardened, isolated environment for performing administrative tasks (Correct answer)
- To replace multi-factor authentication for admins
- To centralize password storage
Correct answer: To provide a hardened, isolated environment for performing administrative tasks
A PAW is a dedicated, hardened workstation used exclusively for privileged tasks, reducing the attack surface for credential theft.
Question 4: Which attack technique involves an adversary extracting password hashes from the LSASS process to gain privileged access?
- Pass-the-ticket
- Credential stuffing
- Pass-the-hash (Correct answer)
- Kerberoasting
Correct answer: Pass-the-hash
Pass-the-hash allows attackers to authenticate using a stolen NTLM hash without knowing the plaintext password.
Question 5: In a PAM context, what does 'password vaulting' primarily accomplish?
- Encrypts all network traffic
- Stores and rotates privileged credentials centrally so humans never see plaintext passwords (Correct answer)
- Generates one-time passwords for end users
- Synchronizes passwords across cloud platforms
Correct answer: Stores and rotates privileged credentials centrally so humans never see plaintext passwords
Password vaulting centralizes storage and automates rotation of privileged credentials, eliminating static, human-known passwords.
Question 6: Which principle recommends granting privileged access only for the duration needed to complete a specific task?
- Zero standing privilege (Correct answer)
- Role-based access control
- Attribute-based access control
- Mandatory access control
Correct answer: Zero standing privilege
Zero standing privilege (ZSP) eliminates persistent privileged accounts by granting access on-demand and revoking it immediately after.
Question 7: When a PAM system requires two authorized individuals to jointly approve and execute a privileged command, this is known as:
- Dual control (Correct answer)
- Two-factor authentication
- Peer review
- Quorum authentication
Correct answer: Dual control
Dual control requires simultaneous involvement of two authorized parties, preventing unilateral execution of sensitive privileged actions.
CIAM Privileged Access 2
Which control specifically prevents a privileged user from reading their own audit logs within a PAM system?