hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A financial institution mandates that all…
A financial institution mandates that all administrative access to network devices must go through a privileged access management (PAM) solution. The PAM solution manages and rotates credentials automatically and logs all sessions. Recently, an auditor discovered that a router's configuration was changed outside of the approved change window. PAM logs show no session during that time. The router supports both local and RADIUS authentication. Which of the following is the MOST likely explanation for the unauthorized change?
⚠ Common exam trap
A common mix-up: candidates assume all administrative access must go through PAM, but they overlook that local accounts on the device itself are not managed by PAM and can be used to make changes without any PAM session log.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A local account on the router was used that is not managed by the PAM solution.
The PAM solution logs all sessions, but the logs show no session during the time of the unauthorized change. Since the router supports both local and RADIUS authentication, the most likely explanation is that a local account (e.g., a console or enable password) was used directly on the router, bypassing the PAM-managed RADIUS authentication entirely. Local accounts are not managed or rotated by the PAM solution, so no session would be recorded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A local account on the router was used that is not managed by the PAM solution.
Why this is correct
This is the most direct and common vulnerability that allows administrative actions to bypass centralized logging. If a router maintains local user accounts or an 'enable secret' password that is not integrated with or managed by the PAM solution, any access performed using these credentials will entirely circumvent the PAM system's session recording, auditing, and logging capabilities. This creates a critical blind spot, enabling unmonitored configuration changes and directly violating the financial institution's mandate for comprehensive administrative access logging.
- ✗
The PAM solution's database was corrupted and failed to log the session.
Why it's wrong here
While database corruption can lead to data loss, it is highly improbable that such an event would selectively affect only a single administrative session's log entry without impacting other records or generating widespread system-level error alerts. A corrupted PAM database would typically manifest as broader data integrity issues, service outages, or clear error messages within the PAM system's own operational logs, making it an unlikely and overly specific explanation for a solitary unlogged event.
- ✗
The router's RADIUS configuration pointed to a different, unmonitored authentication server.
Why it's wrong here
For the router to authenticate against a different, unmonitored RADIUS server, its network configuration would first need to be altered. Such a change itself requires administrative access to the router, which, if properly managed, should have been logged by the PAM solution in the first place. Therefore, this scenario implies a prior, unlogged administrative action to reconfigure the router, making it a secondary effect rather than the primary cause of the initial unlogged access.
- ✗
The network administrator used a shared service account not unique to the PAM system.
Why it's wrong here
The use of a shared service account, if it is *not* managed by the PAM system, would indeed bypass PAM's logging, effectively functioning as an unmanaged local account. However, if the shared account *is* managed by PAM, its usage would be logged, even if individual accountability is reduced. The option describing a 'local account on the router' is a more direct and specific explanation for bypassing PAM's control and logging mechanisms, as it explicitly states the account is 'not managed by the PAM solution'.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.