English
Menu

Cyber Attacks and Defense in Practice

Which of the following is the most appropriate idea of privileged access management (PAM) for protecting server administrator accounts?

  1. AGrant administrator privileges temporarily and only for necessary work after approval, keep privileged passwords in a vault and change them after each use, and record the operations
  2. BGetting approval for each task is a nuisance, so all administrators are left permanently holding administrator privileges on every server
  3. CThe password of the privileged account is shared by all administrators and, so that nobody forgets it, the same value is kept unchanged for years
Show answer and explanation

Answer: A. Grant administrator privileges temporarily and only for necessary work after approval, keep privileged passwords in a vault and change them after each use, and record the operations

Accounts with administrator privileges cause the greatest damage if hijacked, so attackers target them first. In privileged access management, nobody holds the privileges normally; they are granted for a limited time and only after approval for necessary work (just-in-time access), and credentials such as passwords are kept in a vault, not shown directly to people and changed automatically after each use. In addition, administrative work is logged and recorded so that who did what and when can be checked afterwards. This reduces standing powerful privileges and lowers both the damage if they are stolen and the risk of insider misconduct.

  • A. Correct. Limit privileges to when they are needed, manage credentials in a vault and record operations.
  • B. The more accounts that always hold powerful privileges, the greater the damage when one is hijacked.
  • C. Sharing makes it impossible to tell who performed an operation, and using the same value for a long time raises the risk of leaks.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. A developer accidentally committed a configuration file containing an API key for a cloud service to a public Git repository. On noticing, the developer immediately committed a change deleting the file. Which of the following is the most appropriate response after this?
  2. For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?
  3. For ransomware damage, the loss per incident (SLE) is estimated at 40 million yen and the annual number of occurrences (ARO) at 0.5. Control A costs 6 million yen a year and reduces occurrences to 0.2 per year. Control B costs 3 million yen a year and does not change the number of occurrences but speeds up recovery, reducing the loss per incident to 24 million yen. With the annualized loss expectancy ALE = SLE × ARO and ROSI = (reduction in ALE − annual cost of the control) ÷ annual cost of the control, which of the following correctly gives the control with the larger ROSI and its value?
  4. An IDS examines 1 million connections a day, of which 100 are actual attacks. The IDS detects 99% of attacks and wrongly judges 0.1% of non-attack connections to be attacks. Which of the following is closest to the proportion of the alerts raised by the IDS that are actual attacks?
  5. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?

Comparisons in this topic