SSCP Access Controls Practice Question
During a security audit, it is discovered that a service account has been used to log in interactively to a server. The account was originally provisioned only for running a background service. Which PAM (Privileged Access Management) control would best prevent such misuse in the future?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Just-in-time (JIT) provisioning of the service account
Just-in-time (JIT) provisioning grants temporary privileges only when needed, and password vaulting stores credentials securely with automatic rotation. Session recording monitors activity but doesn't prevent misuse. MFA adds a layer but service accounts often can't use MFA interactively. The best preventive control is to restrict interactive logon via policy, but among PAM controls, JIT provisioning ensures the account is not available for interactive use continuously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password vaulting with automatic rotation
Why it's wrong here
Vaulting protects the password but doesn't prevent interactive logon if the account has that right.
- ✗
Requiring multi-factor authentication for the service account
Why it's wrong here
MFA is not typically feasible for automated service accounts.
- ✓
Just-in-time (JIT) provisioning of the service account
Why this is correct
Correct. JIT ensures the account is only active when needed, reducing exposure.
- ✗
Session recording and monitoring
Why it's wrong here
Recording detects misuse but does not prevent it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to ensure that privileged accounts are used only when needed and that all activities are recorded. Which Privileged Access Management (PAM) control should be implemented?
medium- A.Password vaulting
- B.Role-based access control
- C.Multi-factor authentication
- ✓ D.Just-in-Time (JIT) provisioning with session recording
Why D: Just-in-Time (JIT) provisioning grants temporary elevated privileges for specific tasks, reducing the attack surface. Session recording captures all actions for auditing.
Variation 2. An organization has implemented a PAM solution for managing privileged accounts. Which feature allows administrators to request temporary elevated access for a specific task?
medium- A.Session recording
- ✓ B.Just-in-time provisioning
- C.Password vaulting
- D.Role-based access control
Why B: Just-in-time (JIT) provisioning grants temporary privileges as needed, reducing the risk of standing privileges.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.