SY0-701 Question 13
Single answerAuthentication, Authorization, and Accounting (AAA): Authenticating people , Authenticating systems , Authorization modelsA company is replacing shared local administrator passwords on 200 Windows servers with a more secure access model. The security team wants administrators to authenticate with their individual accounts, ensure that only members of the server administration team can manage the servers, and maintain logs showing which person accessed which system. Which solution BEST meets these requirements?
- A
Deploy a privileged access management solution integrated with centralized authentication, assign access through role-based access control, and require administrators to log in with unique accounts
- B
Create one shared domain administrator account for the server team, protect it with a long password, and rotate the password every 30 days
- C
Issue each server a self-signed certificate and allow any administrator to use the local Administrator account as long as the connection is encrypted
- D
Configure mandatory access control labels on the servers and allow administrators to sign in with a generic service account for operational consistency
Show answer and explanation
Correct answer: A
Explanation
The best answer is the solution that satisfies all elements of AAA in a realistic enterprise environment. Authentication of people requires unique user identities rather than shared accounts. Authorization is best handled here with role-based access control (RBAC), because access is tied to a job function such as server administration. Accounting requires logs that map actions to a specific individual, which shared accounts cannot provide. Centralized authentication and PAM are widely recommended in administrative environments to support least privilege, credential management, and auditability. These practices are consistent with common guidance from NIST on identification, authentication, access control, and audit accountability, including principles found in NIST SP 800-63 for digital identity considerations and NIST SP 800-53 controls such as AC (Access Control), AU (Audit and Accountability), and IA (Identification and Authentication).
- A. Correct.
Correct. This approach addresses all three AAA goals in the scenario. Individual administrator accounts provide authentication of people, centralized authentication improves identity management and enforcement, role-based access control (RBAC) provides appropriate authorization based on job function, and a privileged access management (PAM) platform or similar centralized administrative control supports accountability through session tracking and logging. This is aligned with best practices to eliminate shared privileged accounts and enforce least privilege.
- B. Incorrect.
Incorrect. Although rotating a shared privileged password is better than leaving it static, a shared domain administrator account does not provide accountability because logs will show the shared account rather than the individual person who used it. It also violates the requirement for administrators to authenticate with individual accounts. This is a common but weak legacy practice.
- C. Incorrect.
Incorrect. Self-signed certificates may help encrypt a connection in some cases, but they do not solve the core problem of authenticating people or providing accountability. Continuing to use the local Administrator account preserves shared credentials on each server, making it difficult to prove which person performed an action. The presence of encryption does not replace strong identity-based authentication and authorization.
- D. Incorrect.
Incorrect. Mandatory access control (MAC) is an authorization model typically used where access is enforced by classification labels and system policy, not primarily by job-role membership for server administration teams. More importantly, using a generic service account removes individual accountability and does not meet the requirement to identify which person accessed which system. This option mixes an authorization concept with poor authentication and accounting practices.