CISSP Identity and Access Management Practice Question
An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)
⚠ Common exam trap
CISSP often tests whether candidates can distinguish PAM-specific features (vaulting, session recording, JIT) from general IAM features (SSO, RBAC) that are commonly present but not unique to PAM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password vaulting
Password vaulting (B) is a core PAM capability because it stores privileged credentials in an encrypted repository and checks them out to authorized users, removing the need to expose or memorize administrative passwords. Session recording (C) is also a standard PAM feature, as it captures privileged sessions (often via RDP, SSH, or database proxies) for auditing, forensics, and compliance evidence. Just-in-time access (D) is a hallmark of modern PAM because it grants elevated privileges only for a limited time and revokes them automatically, reducing standing administrative rights and the attack surface. Single sign-on (A) and role-based access control (E) are identity and access management concepts that may integrate with PAM, but they are not defining PAM features in the same way as vaulting, session recording, and just-in-time elevation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Single sign-on
Why it's wrong here
Single sign-on (SSO) allows users to authenticate once and gain access to multiple independent software systems without re-entering credentials. While it streamlines user experience and simplifies general authentication, SSO is not a specific feature of Privileged Access Management (PAM). PAM focuses on the unique security challenges of managing, monitoring, and controlling highly sensitive privileged accounts, rather than merely simplifying general user login experiences.
- ✓
Password vaulting
Why this is correct
Password vaulting is a fundamental PAM capability that centralizes the secure storage of privileged account credentials, such as administrator passwords and SSH keys, in an encrypted and isolated repository. It enforces strong password policies, automates credential rotation at defined intervals, and manages the secure retrieval and injection of these credentials into target systems, eliminating direct user knowledge of the actual passwords. This significantly reduces the risk of credential theft and misuse.
- ✓
Session recording
Why this is correct
Session recording within a PAM solution captures and stores a complete, immutable video-like record of all activities performed during a privileged session. This includes keystrokes, mouse movements, and screen content, providing a detailed forensic audit trail for compliance, incident investigation, and accountability. It ensures transparency and non-repudiation for actions taken by privileged users on critical systems.
- ✓
Just-in-time access
Why this is correct
Just-in-time (JIT) access is a core PAM principle that grants privileged permissions only for a specific, limited duration and for a defined task, upon explicit request and approval. This eliminates standing privileges, significantly reducing the attack surface by ensuring that high-level access exists only when actively needed. Once the task is complete or the time expires, the privileges are automatically revoked, enforcing the principle of least privilege.
- ✗
Role-based access control
Why it's wrong here
Role-based access control (RBAC) is a general access control model where permissions are assigned to roles, and users are assigned to roles, thereby inheriting their associated permissions. While PAM solutions can utilize RBAC to define who is authorized to request privileged access, RBAC itself is a broad access management framework applicable to all user types and systems, not a specific feature designed to manage the lifecycle, monitoring, or just-in-time provisioning of privileged credentials or sessions.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Privileged access management
Privileged access management is a cybersecurity practice that controls and monitors the elevated access rights of users who have special permissions to critical systems and data.
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.