Quiz: Privileged Access Management
A 26-question self-check covering the chapter's vocabulary, the escalation ladder, and the PAM control set. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] An account that can administer other accounts, change security settings, or control infrastructure is best called a: A. service account B. privileged account C. orphaned account D. federated account
2. [Sec+] Storing privileged credentials in a secured, audited repository and brokering access so a human need not know a password to use it is called: A. password rotation B. credential vaulting C. tiered administration D. single sign-on
3. The technique by which an attacker authenticates to a new machine by replaying a stolen credential without knowing or cracking the password is: A. password spraying B. pass-the-hash C. credential stuffing D. phishing
4. [CISSP] Granting a privileged role only for a bounded window and removing it automatically, so no standing privileged access exists by default, is: A. just-in-time access B. least functionality C. mandatory access control D. federation
5. In the §19.1 escalation ladder, the step that directly enables lateral movement is: A. initial foothold B. domain dominance C. credential harvesting D. business email compromise
6. [Sec+] A dedicated, hardened computer used only for privileged administration (no email, no web) is a: A. jump host B. bastion host C. privileged access workstation (PAW) D. domain controller
7. In the classic three-tier administration model, domain controllers and the identity/control plane belong to: A. Tier 2 B. Tier 1 C. Tier 0 D. the DMZ
8. [CISSP] The core rule of tiered administration is: A. all admins share one powerful account B. higher-tier credentials are never exposed on lower tiers C. credentials may flow upward but not sideways D. only Tier 2 uses MFA
9. Check-in (one-time) rotation rotates a privileged credential: A. once a year B. immediately after each session ends C. only when an admin leaves D. only after a breach
10. [Sec+] A highly privileged account reserved for emergencies (e.g., when the PAM system or MFA is down), stored offline and alerting on any use, is a: A. service account B. break-glass account C. shared mailbox D. machine identity
11. The single most valuable detection that PAM creates (that did not exist before) is: A. failed-password alerting B. a privileged logon with no matching vault checkout C. antivirus signature hits D. DNS tunneling detection
12. Microsoft LAPS most directly defeats which lateral-movement enabler? A. weak domain admin passwords B. a shared/identical local Administrator password across machines C. missing MFA on email D. open firewall ports
13. [CISSP] Requiring a second person's approval before a high-risk privileged role can be activated is an application of: A. defense in depth B. separation of duties C. fail-safe defaults D. non-repudiation
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
14. "Because privileged actions are rare and significant, privileged-account detections tend to be higher-fidelity than detections on ordinary user activity."
15. [Sec+] "If our admins all have strong, unique passwords, pass-the-hash is not a concern."
16. "Just-in-time access reduces risk by reducing the scope of what a privileged role can do."
17. "A break-glass account should be exempt from monitoring and rotation, since it is only for emergencies."
18. [CISSP] "Tiering that exists only as a written policy, with no operating-system enforcement, is effectively no control at all against a determined or rushed admin."
19. "Session recording of privileged sessions raises no privacy or legal considerations and can be deployed without disclosure."
Section 3 — Fill in the blank (1 pt each)
20. The escalation ladder runs: foothold → local privilege escalation → credential _ → _ movement → domain admin → domain dominance.
21. [Sec+] Automatically changing a privileged credential on a schedule or after each use, to shorten the useful life of any stolen credential, is called password __.
22. A __ account is a non-human account that runs an application or scheduled task, often with elevated rights — introduced in this chapter and treated fully in Chapter 20.
23. The deepest payoff of PAM is that, by forcing all privileged access through a narrow instrumented path, it makes the misuse of privilege __ (i.e., easy to detect).
Section 4 — Short answer (2 pts each)
24. [CISSP] In two or three sentences, explain how tiered administration with enforced logon restrictions prevents a compromised user workstation from leading to domain admin — even after the attacker becomes local administrator of that workstation.
25. A board member asks, "We already have multi-factor authentication on admin logins. Why spend more on this PAM thing?" In two or three sentences, explain what PAM adds beyond login MFA, referencing standing access and credential harvesting.
Section 5 — Applied scenario (5 pts)
26. [Sec+] Meridian discovers a domain admin account (DOMAIN\da-legacy) that is a standing member of
Domain Admins, has a password unchanged for 14 months, is shared by three engineers, is not in the PAM
vault, and has logged on to ordinary user laptops to "fix things." (a) Identify every PAM control this
account violates. (b) Walk the §19.1 escalation ladder to explain the worst-case blast radius if this
account's credential is harvested from one of those laptops. (c) Propose the specific remediation for each
violation, naming the control from this chapter. (d) State one detection you would add to catch future
misuse of this (or any) privileged account.