ISC2 CC Access Controls Concepts Practice Question
An organization uses a Privileged Access Management (PAM) solution. Which of the following is a primary benefit of PAM?
⚠ Common exam trap
CC often tests the confusion between PAM and IGA/SSO — candidates pick 'automates user provisioning' or 'single sign-on' because those sound like identity benefits, but PAM is specifically about privileged account control and monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Controls and monitors privileged access
PAM solutions are designed to secure, control, and monitor privileged accounts — the accounts with elevated access such as root, domain admin, and service accounts. Core PAM capabilities include credential vaulting, session recording, just-in-time access, and approval workflows for privileged actions. The primary benefit is therefore controlling and monitoring privileged access to reduce the risk of misuse or compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Controls and monitors privileged access
Why this is correct
PAM brokers privileged accounts through vaulting, session isolation and credential checkout, so administrative actions are both restricted and recorded. This controls and monitors privileged access, satisfying the stem's requirement for a primary benefit rather than general authentication or endpoint protection.
- ✗
Provides a single sign-on for all users
Why it's wrong here
PAM brokers privileged sessions and vaults administrative credentials; it does not provide single sign-on, which is an identity federation function of Microsoft Entra ID. SSO is tempting because both reduce password sprawl, and SSO would be correct when the goal is one authentication for standard user applications.
- ✗
Eliminates the need for passwords
Why it's wrong here
PAM vaults and rotates privileged credentials, so passwords remain central rather than eliminated; passwordless authentication is delivered by FIDO2 or Windows Hello. Elimination is tempting because vaulting hides credentials from administrators, and passwordless would be correct when the requirement is removing shared secrets from user logon.
- ✗
Automates user provisioning for all accounts
Why it's wrong here
PAM controls and audits privileged sessions; automated provisioning of all accounts is identity governance, typically handled through Microsoft Entra ID lifecycle workflows. Provisioning is tempting because PAM onboards privileged accounts, and it would be correct when the requirement is joiner-mover-leaver automation across the directory.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.