CAS-005 · Question #178
A security team receives an escalated support ticket for a user who is unable to access specific corporate resources. The following configurations exist in the corporation: - A device certificate is…
The correct answer is A. The user's administrator credentials likely expired after 90 days. The user's inability to access privileged systems after 90+ days of leave, despite SSO working for general access, strongly suggests that their administrator credentials or associated access rights have expired due to inactivity.
Question
A security team receives an escalated support ticket for a user who is unable to access specific corporate resources. The following configurations exist in the corporation:
- A device certificate is deployed on all corporate assets.
- Templates for unique user certificates are configured.
- Security updates are installed every 30 days.
- Administrator access is tied to specific hosts.
The ticket contains the following observations:
- The user has been on leave for more than 90 days.
- Internal vulnerability scans indicate no device issues.
- Single sign-on works as expected.
- Privileged systems are not accessible.
Which of the following best describes the root cause?
Options
- AThe user's administrator credentials likely expired after 90 days.
- BThe device being utilized does not have user binding established.
- CSeveral patch cycles have been missed while the user was on leave.
- DIncorrect certificate extensions have been added to the templates.
How the community answered
(40 responses)- A75% (30)
- B13% (5)
- C5% (2)
- D8% (3)
Why each option
The user's inability to access privileged systems after 90+ days of leave, despite SSO working for general access, strongly suggests that their administrator credentials or associated access rights have expired due to inactivity.
Organizations often implement policies where privileged credentials or access to administrative roles expire or require revalidation after a period of inactivity, such as 90 days, to reduce the risk associated with dormant high-privilege accounts.
The prompt states that unique user certificates are configured and SSO works, implying device and user binding is generally established for regular access, and the issue is specifically with privileged access.
While missed patches could be an issue, the prompt explicitly states 'Internal vulnerability scans indicate no device issues' and that security updates are installed every 30 days, making this less likely the root cause for this specific user's access problem.
If incorrect certificate extensions were added to templates, it would likely affect many users or general certificate issuance, not just a specific user's privileged access after a long leave.
Concept tested: Privileged account lifecycle management
Source: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure-role-settings
Community Discussion
No community discussion yet for this question.