CIAM Privileged Access 3 — Questions and Answers
Question 1: A service account has been granted local administrator rights on 500 servers with the same password. Which PAM risk does this represent?
- Credential sprawl
- Lateral movement risk (Correct answer)
- Privilege creep
- Shadow IT
Correct answer: Lateral movement risk
Shared static credentials across many systems allow an attacker who compromises one system to move laterally across the entire environment.
Question 2: Which IAM concept ensures that privileged access rights are removed when an employee changes roles or leaves the organization?
- Access recertification (Correct answer)
- Provisioning
- Federation
- Single sign-on
Correct answer: Access recertification
Access recertification (also called access review) is the periodic process of validating and revoking unnecessary or outdated access rights.
Question 3: What is 'privilege creep' in identity and access management?
- A malware that escalates privileges automatically
- The gradual accumulation of access rights beyond what a user's current role requires (Correct answer)
- Unauthorized privilege delegation to a third party
- The process of expanding admin privileges during incident response
Correct answer: The gradual accumulation of access rights beyond what a user's current role requires
Privilege creep occurs when users accumulate permissions over time through role changes without prior access being removed.
Question 4: Which component of a PAM architecture acts as a proxy to enforce session control and policy without exposing target system credentials to end users?
- Identity broker
- Privileged access gateway (Correct answer)
- Directory server
- Token service
Correct answer: Privileged access gateway
A privileged access gateway sits between the admin and the target system, injecting credentials and enforcing policy transparently.
Question 5: Under the NIST SP 800-53 framework, which control family primarily addresses privileged account management?
- Access Control (AC) (Correct answer)
- Audit and Accountability (AU)
- Identification and Authentication (IA)
- System and Communications Protection (SC)
Correct answer: Access Control (AC)
The Access Control family, particularly AC-2 and AC-6, governs privileged account management and least-privilege enforcement.
Question 6: An attacker exploits a Kerberos vulnerability to forge tickets granting domain admin access. What is this attack called?
- Silver ticket attack
- Golden ticket attack (Correct answer)
- Pass-the-ticket
- AS-REP roasting
Correct answer: Golden ticket attack
A golden ticket attack forges Kerberos TGTs using the krbtgt account hash, granting persistent domain admin access.
Question 7: Which privileged access control method limits what commands a sudo user can run by defining rules in a configuration file?
- RBAC policy
- Sudoers file (Correct answer)
- Group Policy Object
- Access control list
Correct answer: Sudoers file
The /etc/sudoers file defines granular rules specifying which users can run which commands with elevated privileges on Unix/Linux systems.
CIAM Privileged Access 3
A service account has been granted local administrator rights on 500 servers with the same password.
Which PAM risk does this represent?