CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Self-service password reset

  Why it's wrong here

  Self-service password reset allows users to regain access to their accounts without administrator intervention, typically by verifying their identity through pre-registered methods. While beneficial for reducing help desk load and improving user experience across an organization, this feature is a general identity and access management (IAM) capability. It is not inherently a characteristic or core function specifically designed for managing, monitoring, or securing privileged accounts, which require more stringent controls.

• ✓

  Session recording

  Why this is correct

  Session recording is a critical characteristic of Privileged Access Management (PAM) systems, capturing video-like records of all activities performed by privileged users during their elevated sessions. This capability provides an immutable audit trail, enabling forensic analysis, compliance reporting, and real-time monitoring of sensitive operations. By documenting every command and action, organizations can ensure accountability and detect unauthorized or suspicious behavior associated with high-risk accounts.

• ✗

  Single sign-on for all users

  Why it's wrong here

  Single sign-on (SSO) for all users is an identity management feature that allows users to authenticate once and gain access to multiple independent software systems without re-entering credentials. While SSO enhances user convenience and security by reducing password fatigue for all users, it is a broad enterprise-wide IAM strategy. PAM specifically focuses on the unique challenges and heightened security requirements of privileged accounts, which often involve additional layers of control beyond standard SSO.

• ✓

  Password vaulting

  Why this is correct

  Password vaulting is a fundamental component of Privileged Access Management (PAM), providing a secure, centralized repository for storing and managing highly sensitive credentials for privileged accounts. This mechanism ensures that privileged passwords are never directly exposed to administrators, instead being retrieved and injected automatically by the PAM system when access is granted. It enforces strong password policies, automates password rotation, and eliminates hardcoded credentials, significantly reducing the risk of credential theft and misuse.

• ✗

  OpenID Connect authentication

  Why it's wrong here

  OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol, enabling clients to verify the identity of the end-user based on the authentication performed by an authorization server. As a modern authentication protocol, OIDC facilitates secure identity verification and information exchange, commonly used for web and mobile applications. While PAM systems might integrate with OIDC for their own administrative interfaces, OIDC itself is a general authentication standard and not a core feature or characteristic of privileged access management functionality.

Go deeper

Related to this question