SY0-701 Question 373
Single answerPrivileged access management tools: Just-in-time permissions , Password vaultingA security administrator at a healthcare company needs to reduce the risk of privileged account misuse on Windows and Linux servers. Administrators currently share a spreadsheet of local admin and root passwords, and several staff members have standing privileged access even though they only need elevation occasionally for maintenance. The company wants to improve accountability, reduce credential exposure, and ensure elevated access is available only when approved and only for a limited time. Which solution BEST meets these requirements?
- A
Deploy a privileged access management solution that stores administrator credentials in a password vault and grants just-in-time elevation for approved maintenance windows
- B
Require administrators to memorize unique passwords for each server and request manager approval before using them
- C
Implement single sign-on for all administrative accounts so administrators can use one credential across all servers without checking out passwords
- D
Create separate shared admin accounts for each team and rotate those passwords monthly using a documented change process
Show answer and explanation
Correct answer: A
Explanation
The best answer is the PAM approach that combines password vaulting with just-in-time permissions. Password vaulting protects privileged credentials by storing them in a controlled repository, limiting direct knowledge of passwords, enforcing checkout procedures, and supporting auditing and rotation. Just-in-time access reduces standing privileges by granting elevated rights only for a specific task, after approval if required, and for a limited duration. Together, these controls support least privilege, improve accountability, and reduce the risk of credential theft or misuse.
This aligns with common security best practices promoted across industry guidance, including least privilege and privileged account management concepts referenced by NIST and other security frameworks. In practical environments, PAM tools are used to manage administrative credentials, provide auditable access workflows, rotate passwords, and issue temporary elevation rather than leaving users permanently privileged. That combination is the most effective response to the scenario's goals of reducing credential exposure, preventing shared-password misuse, and eliminating unnecessary standing administrative access.
- A. Correct.
Correct. This directly addresses both core problems in the scenario: password vaulting replaces insecure shared spreadsheets by securely storing and controlling access to privileged credentials, and just-in-time (JIT) permissions remove unnecessary standing privileges by granting elevation only when needed, typically for a defined period and with approval and logging. This improves accountability through audit trails and reduces the attack surface created by persistent privileged access.
- B. Incorrect.
Incorrect. Unique passwords and manager approval may improve process discipline, but this does not solve the main technical problems. Administrators would still be handling privileged credentials directly, which increases exposure risk, and there is no mechanism here for centralized vaulting, automated checkout, session auditing, or temporary privilege assignment. Memorization is also not practical or scalable for privileged accounts across many systems.
- C. Incorrect.
Incorrect. Single sign-on (SSO) can improve usability, but it is not a substitute for privileged access management. In this scenario, the issue is controlling and limiting privileged credentials and standing admin rights. SSO does not inherently provide password vaulting for local admin/root accounts or JIT elevation. In some cases, broad SSO access to administrative functions could even increase risk if not paired with PAM controls.
- D. Incorrect.
Incorrect. Separate shared accounts and monthly rotation are better than one shared spreadsheet password, but shared accounts still weaken individual accountability because multiple people can use the same credential. Monthly rotation also does not address the problem of standing privilege. Best practice is to avoid persistent broad access and to use vaulted credentials with time-bound, approved elevation whenever possible.