SY0-701 Question 375
Single answerEphemeral credentialsA company is moving its administrative access model to reduce the risk of stolen credentials being reused. Administrators currently log in to production systems with named accounts that use long-lived passwords stored in a password vault. After a recent phishing incident, the security team wants a solution that gives admins access only when needed, automatically expires access after a short period, and limits the usefulness of captured credentials. Which approach BEST meets these requirements?
- A
Issue just-in-time ephemeral credentials after strong authentication, with short time-to-live values and automatic expiration
- B
Increase password complexity requirements for administrator accounts and rotate the passwords every 30 days
- C
Store administrator SSH keys in an encrypted shared drive and require admins to check them out before use
- D
Configure service accounts with non-expiring credentials so administrative tasks are not interrupted during incidents
Show answer and explanation
Correct answer: A
Explanation
Ephemeral credentials are temporary authentication artifacts such as short-lived tokens, session credentials, or certificates that expire automatically after a defined period. They are commonly used in just-in-time (JIT) and least-privilege access models to reduce standing privilege and limit credential replay opportunities. Compared with long-lived passwords or shared keys, ephemeral credentials better support accountability, shorter exposure windows, and reduced impact from phishing or credential theft. This aligns with broadly accepted security best practices promoted by standards and guidance such as NIST's emphasis on least privilege, session management, and minimizing persistent privileged access. In practical environments, ephemeral credentials are often combined with MFA, privileged access management workflows, and centralized logging to ensure that elevated access is granted only for approved tasks and only for as long as necessary.
- A. Correct.
This is correct because ephemeral credentials are designed to be temporary, issued only when needed, and invalidated automatically after a short duration. In a just-in-time access model, an administrator authenticates strongly, receives a short-lived token, certificate, or session credential, and uses it only for the approved task window. If the credential is intercepted or stolen, its limited lifetime reduces the opportunity for reuse. This directly addresses the requirement to minimize standing privileges and reduce the value of captured credentials.
- B. Incorrect.
This is incorrect because stronger passwords and more frequent rotation improve password hygiene, but they do not eliminate the core problem of long-lived credentials. A password valid for days or weeks can still be stolen and reused well after the initial compromise. This option represents a common misconception that password policy alone provides the same risk reduction as temporary, expiring access.
- C. Incorrect.
This is incorrect because placing shared administrator keys on an encrypted drive may improve storage protection, but the keys are still long-lived credentials. Shared use also reduces accountability and complicates auditing because multiple people may use the same key material. Ephemeral credentials are preferred because they are issued per user or session and expire automatically.
- D. Incorrect.
This is incorrect because non-expiring credentials increase risk rather than reduce it. Although organizations may want reliability during incidents, permanent service credentials create persistent attack paths if they are exposed. This option conflicts with the stated goal of limiting the usefulness of captured credentials and reducing standing access.