An organization wants to implement a privileged access management (PAM) solution to manage administrative credentials. They require that administrators request temporary access to privileged accounts and that these credentials are automatically rotated after each use. Which PAM approach best meets these requirements?
Trap 1: Password vaulting with checkout
Password vaulting with checkout stores credentials in a secure repository and allows administrators to check them out temporarily, but it typically does not provide automatic rotation after each use.
Trap 2: Privileged account session management
Privileged account session management records and monitors sessions but does not inherently rotate credentials or provide just-in-time access.
Trap 3: Break-glass account procedures
Break-glass account procedures are designed for emergency access and bypass normal controls; they are not intended for daily administrative tasks and do not include credential rotation.
- A
Password vaulting with checkout
Why wrong: Password vaulting with checkout stores credentials in a secure repository and allows administrators to check them out temporarily, but it typically does not provide automatic rotation after each use.
- B
Just-in-time access provisioning with credential rotation
Just-in-time access provisioning with credential rotation directly meets the requirements by granting temporary privileges that expire and automatically rotating credentials after each session.
- C
Privileged account session management
Why wrong: Privileged account session management records and monitors sessions but does not inherently rotate credentials or provide just-in-time access.
- D
Break-glass account procedures
Why wrong: Break-glass account procedures are designed for emergency access and bypass normal controls; they are not intended for daily administrative tasks and do not include credential rotation.