CAS-004 Security Engineering Practice Question
A company is implementing privileged access management (PAM) for its critical servers. Which THREE practices should be included to enhance security? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Record and monitor all privileged sessions
Just-in-time (JIT) access provisioning grants privileges only when needed, reducing standing privileges. Session recording and monitoring provides audit trails. Break-glass accounts provide emergency access with controls. MFA for all users is a general practice, but for PAM, JIT, session monitoring, and break-glass are specific. Password rotation is good but not a core PAM practice compared to the others.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Record and monitor all privileged sessions
Why this is correct
Session recording ensures accountability and aids forensic analysis.
- ✓
Implement just-in-time (JIT) access provisioning
Why this is correct
JIT reduces the attack surface by granting temporary privileges.
- ✓
Use break-glass accounts for emergency access
Why this is correct
Break-glass accounts provide controlled emergency access that can be audited.
- ✗
Enforce multi-factor authentication for all users
Why it's wrong here
While MFA is important, it is not specific to PAM; the question asks for practices for PAM.
- ✗
Require periodic password rotation for all service accounts
Why it's wrong here
Password rotation is a general best practice but not as specific to PAM as the other three.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.