CIAM Privileged Access 4

Question 1

Which best practice addresses the risk of an administrator using a single account for both privileged and non-privileged tasks?

Accepted Answer

Requiring separate admin and standard user accounts

Answer

Maintaining separate accounts for privileged and day-to-day activities limits the exposure of admin credentials during routine browsing or email.

Question 2

What is the main risk of using shared privileged accounts (e.g., a single 'root' account used by multiple administrators)?

Accepted Answer

Inability to attribute actions to a specific individual

Answer

Shared accounts break accountability because audit logs cannot determine which individual performed a privileged action.

Question 3

A cloud administrator is granted temporary elevated access via an automated workflow that expires after 4 hours. This is an example of:

Accepted Answer

Just-in-time (JIT) privileged access

Answer

Just-in-time privileged access grants elevated permissions on-demand for a limited time window and revokes them automatically.

Question 4

Which control helps detect a compromised privileged account by establishing a baseline of normal behavior and alerting on deviations?

Accepted Answer

User and Entity Behavior Analytics (UEBA)

Answer

UEBA uses machine learning to model normal privileged user behavior and flags anomalous activities that may indicate compromise.

Question 5

In a PAM deployment, what is the purpose of 'application-to-application password management' (AAPM)?

Accepted Answer

To eliminate hard-coded credentials in scripts and applications by fetching secrets at runtime

Answer

AAPM removes hard-coded or embedded credentials from applications by having them retrieve secrets dynamically from a vault.

(CIAM) Certified Identity and Access Manager Practice Test