CISSP Identity and Access Management Practice Question
In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?
⚠ Common exam trap
CISSP often tests the difference between password vaulting and JIT access; candidates may confuse vaulting (credential storage) with JIT (temporary elevation), but the question specifically asks for temporary elevation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Just-in-time (JIT) access
Just-in-time (JIT) access in a PAM solution provides temporary, on-demand elevation of privileges for specific tasks, eliminating standing privileges that attackers can exploit. It typically involves approval workflows, time-bound access, and automatic revocation. This reduces the attack surface and limits lateral movement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password vaulting
Why it's wrong here
Password vaulting is a foundational component of a Privileged Access Management (PAM) solution, designed to securely store, manage, and rotate credentials for privileged accounts. While it centralizes secret management and enhances credential hygiene by eliminating hardcoded passwords, it primarily addresses the secure storage and retrieval of secrets. It does not inherently eliminate standing privileges, as users might still be granted continuous access to the vault or the accounts managed by it, even if the credentials themselves are regularly rotated.
- ✓
Just-in-time (JIT) access
Why this is correct
Just-in-time (JIT) access is a critical security feature within a PAM solution that grants elevated privileges only when needed and for a strictly limited duration. This approach minimizes the attack surface by eliminating standing privileges, ensuring that users possess administrative rights solely for the specific task and time required. Once the task is completed or the predefined time expires, the privileges are automatically revoked, significantly reducing the window of opportunity for credential misuse or compromise.
- ✗
Break-glass account
Why it's wrong here
A break-glass account is a highly privileged emergency account designed for use during critical system failures or when standard access mechanisms are unavailable. While it provides elevated access, its purpose is for exceptional, unforeseen circumstances, not for routine administrative tasks or as a mechanism to implement regular time-limited access. Its existence is a contingency, and its use is typically heavily audited and restricted, distinct from the proactive privilege reduction offered by JIT.
- ✗
Session recording
Why it's wrong here
Session recording in a PAM solution captures and logs all activities performed during a privileged session, providing an immutable audit trail for accountability, compliance, and forensic analysis. While it is an essential detective control for monitoring, compliance, and incident response, session recording does not prevent or reduce the existence of standing privileges. It merely records what happens *after* privileges have been granted, thus not addressing the core problem of excessive or continuous access rights.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.