hardMultiple ChoiceObjective-mapped
CISSP Privileged Access Management (PAM) Practice Question
A global manufacturing company with headquarters in Europe and factories in Asia and North America has recently experienced a data breach. The breach involved the theft of intellectual property (IP) containing product designs stored on a file server located in the Asian factory. The investigation revealed that the attacker gained access using a compromised administrator account from a contractor's laptop that was connected to the corporate VPN. The company has implemented network segmentation, but the file server resides in the same VLAN as other factory equipment. The company uses Active Directory for identity management, and all employees and contractors use the same domain. The company is now reviewing its data governance policies to prevent future incidents. The security team must recommend a set of controls that address the root cause while maintaining operational efficiency. Which of the following is the BEST course of action?
⚠ Common exam trap
AI-generated trap: Many candidates may default to implementing MFA as the primary solution, but the question stresses that the breach involved both compromised credentials and an unmanaged device. The correct answer (PAM with JIT and compliant device requirements) addresses both issues simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a privileged access management (PAM) solution with just-in-time (JIT) elevation and conditional access policies that require managed, compliant devices for VPN access
The best course of action because implementing a privileged access management (PAM) solution with just-in-time (JIT) elevation and conditional access policies (e.g., requiring managed, compliant devices for VPN access) directly addresses the root cause: the use of compromised administrator credentials from an unmanaged contractor device. This control ensures that privileged access is granted only when needed, for a limited time, and only from devices that meet security baselines. Option A (separate Active Directory forest with one-way trust) adds significant administrative overhead and complexity without preventing credential misuse. Option C (MFA for all users) improves authentication security but does not require device compliance, so a compromised but MFA-enabled device could still be used for lateral movement. Option D (isolating the file server in its own VLAN with strict firewall rules) is a good network control but does not address the credential theft or the unmanaged device vector; the attacker could still access the server remotely through VPN if credentials are valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a separate Active Directory forest for contractors and establish a one-way trust to allow access only to necessary resources
Why it's wrong here
Requiring MFA for all VPN users is a good security practice but does not address the fact that the contractor's device was compromised and likely infected with malware that could still operate after VPN login.
- ✓
Implement a privileged access management (PAM) solution with just-in-time (JIT) elevation and conditional access policies that require managed, compliant devices for VPN access
Why this is correct
This comprehensive approach directly addresses the core issues. Privileged Access Management (PAM) with Just-in-Time (JIT) elevation ensures that privileged credentials are not persistently available, significantly reducing the window of opportunity for an attacker to exploit them even if they compromise an endpoint. Crucially, conditional access policies requiring managed, compliant devices prevent unmanaged or compromised contractor laptops from establishing a VPN connection in the first place, thereby blocking the initial vector of compromise and ensuring a secure endpoint posture before network access is granted.
- ✗
Require multi-factor authentication (MFA) for all users accessing the VPN, regardless of role
Why it's wrong here
While multi-factor authentication (MFA) significantly strengthens authentication by requiring multiple verification factors, it primarily protects against the use of stolen credentials. If the contractor's device is already compromised with malware, such as a remote access trojan or keylogger, the attacker can operate from the authenticated session after MFA has been successfully completed. The malware can persist and allow the attacker to control the device and access resources, effectively bypassing the MFA's protective barrier post-authentication.
- ✗
Isolate the file server into its own VLAN and implement strict firewall rules to limit access to only necessary personnel
Why it's wrong here
Isolating the file server into a dedicated VLAN with strict firewall rules enhances network segmentation and limits direct exposure. However, this measure does not prevent an attacker from gaining an initial foothold via a compromised contractor device that has successfully established a VPN connection. Once inside the network perimeter, even if segmented, the attacker can still leverage the compromised endpoint to perform reconnaissance, pivot to other systems, or exploit other vulnerabilities to eventually reach the file server or other critical assets, circumventing the VLAN's intended isolation.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.