CIAM Privileged Access 5

Question 1

What is a 'break-glass' account in PAM, and when is it used?

Accepted Answer

An emergency account with high privileges used only when normal admin access is unavailable

Answer

Break-glass accounts provide emergency access during system outages or lockouts and are tightly monitored because their use signals an exceptional event.

Question 2

Which PAM metric best indicates whether the principle of least privilege is being enforced across an organization?

Accepted Answer

Percentage of users with admin rights relative to total user population

Answer

A low ratio of privileged users to total users indicates least privilege is being enforced; a high ratio suggests over-provisioning.

Question 3

Which cloud-native feature in AWS allows services to assume a role with temporary credentials instead of using long-term access keys?

Accepted Answer

IAM roles with STS

Answer

AWS IAM roles combined with the Security Token Service (STS) provide temporary, automatically rotated credentials, eliminating long-term static keys.

Question 4

When evaluating a PAM vendor, which capability ensures that privileged credentials are rotated immediately after each use?

Accepted Answer

One-time password (OTP) for privileged accounts

Answer

OTP-based privileged access generates a unique password for each session, invalidating it immediately after the session ends.

Question 5

A red team finds that a developer's workstation stores SSH private keys in plaintext, providing root access to production. Which PAM gap does this expose?

Accepted Answer

Unmanaged privileged credentials outside the vault

Answer

Unmanaged SSH keys stored outside a PAM vault represent ungoverned privileged credentials that bypass all vault controls and audit trails.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Privileged Access 5