CISSP Identity and Access Management Practice Question
An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password vaulting
PAM typically includes password vaulting, session recording, and just-in-time access. Break-glass accounts are also a feature, but the question asks for three of the most common.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Single sign-on
Why it's wrong here
Single sign-on (SSO) allows users to authenticate once and gain access to multiple independent software systems without re-entering credentials. While it streamlines user experience and simplifies general authentication, SSO is not a specific feature of Privileged Access Management (PAM). PAM focuses on the unique security challenges of managing, monitoring, and controlling highly sensitive privileged accounts, rather than merely simplifying general user login experiences.
- ✓
Password vaulting
Why this is correct
Password vaulting is a fundamental PAM capability that centralizes the secure storage of privileged account credentials, such as administrator passwords and SSH keys, in an encrypted and isolated repository. It enforces strong password policies, automates credential rotation at defined intervals, and manages the secure retrieval and injection of these credentials into target systems, eliminating direct user knowledge of the actual passwords. This significantly reduces the risk of credential theft and misuse.
- ✓
Session recording
Why this is correct
Session recording within a PAM solution captures and stores a complete, immutable video-like record of all activities performed during a privileged session. This includes keystrokes, mouse movements, and screen content, providing a detailed forensic audit trail for compliance, incident investigation, and accountability. It ensures transparency and non-repudiation for actions taken by privileged users on critical systems.
- ✓
Just-in-time access
Why this is correct
Just-in-time (JIT) access is a core PAM principle that grants privileged permissions only for a specific, limited duration and for a defined task, upon explicit request and approval. This eliminates standing privileges, significantly reducing the attack surface by ensuring that high-level access exists only when actively needed. Once the task is complete or the time expires, the privileges are automatically revoked, enforcing the principle of least privilege.
- ✗
Role-based access control
Why it's wrong here
Role-based access control (RBAC) is a general access control model where permissions are assigned to roles, and users are assigned to roles, thereby inheriting their associated permissions. While PAM solutions can utilize RBAC to define who is authorized to request privileged access, RBAC itself is a broad access management framework applicable to all user types and systems, not a specific feature designed to manage the lifecycle, monitoring, or just-in-time provisioning of privileged credentials or sessions.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Privileged access management
Privileged access management is a cybersecurity practice that controls and monitors the elevated access rights of users who have special permissions to critical systems and data.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.