A security analyst is reviewing logs and notices that a domain admin account was used to logon to a server that the admin does not normally access. The logon occurred at 3:00 AM. What should the analyst do first?

Ignore the event because it is a one-time occurrence.

Change the admin's password and force a logout.

Correlate the logon event with other logs, such as authentication and process creation, to determine if it was legitimate.

Disable the domain admin account immediately.

A security team wants to implement just-in-time administration for break-glass access to a critical server. The access should be temporary, approved, and fully auditable. Which solution meets these requirements?

Grant the administrator permanent remote desktop rights to the server and rely on MFA.

Allow the administrator to use their domain admin account to access the server when needed.

Create a permanent local admin account on the server and store the password in a sealed envelope.

Use a PAM solution that requires an approval workflow, grants time-limited access, and logs all sessions.

A systems administrator uses a single Active Directory account that is a member of Domain Admins for all daily tasks, including checking email and browsing the web. The security team wants to reduce the risk of credential theft and lateral movement. Which approach best aligns with least privilege and privileged account management?

Use a password manager to store the Domain Admin password and share it with the IT team for daily use.

Create a separate unprivileged account for daily work and a dedicated privileged account used only for administrative tasks, with MFA enforced on the privileged account.

Keep the single account but require smart card authentication for all logons, including email and web browsing.

Remove the account from Domain Admins and add it to the local Administrators group on all workstations.

A company has several service accounts with high privileges. The security team wants to reduce the risk of these credentials being used by attackers. Which practice is most effective?

Set a very long static password and store it in a shared spreadsheet.

Use managed service accounts and automatically rotate passwords on a regular schedule.

Require MFA for service account logons.

Disable the service accounts and use user accounts with the same privileges.

GIAC Defending Advanced Threats

Domain 3Objective 1

Administrative Access GDAT Practice Questions (Page 3)

Part of the Credential and Privilege Management domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 11–15

11foundation · easy
Which type of privileged account is typically used by an application or service to interact with the operating system or other services?
Select an answer first
12application · medium
A security analyst is reviewing logs and notices that a domain admin account was used to logon to a server that the admin does not normally access. The logon occurred at 3:00 AM. What should the analyst do first?
Select an answer first
13application · medium
A security team wants to implement just-in-time administration for break-glass access to a critical server. The access should be temporary, approved, and fully auditable. Which solution meets these requirements?
Select an answer first
14application · medium
A systems administrator uses a single Active Directory account that is a member of Domain Admins for all daily tasks, including checking email and browsing the web. The security team wants to reduce the risk of credential theft and lateral movement. Which approach best aligns with least privilege and privileged account management?
Select an answer first
15application · medium
A company has several service accounts with high privileges. The security team wants to reduce the risk of these credentials being used by attackers. Which practice is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Administrative Access GDAT Practice Questions (Page 3)

Questions 11–15

Which type of privileged account is typically used by an application or service to interact with the operating system or other services?

A security analyst is reviewing logs and notices that a domain admin account was used to logon to a server that the admin does not normally access. The logon occurred at 3:00 AM. What should the analyst do first?

A security team wants to implement just-in-time administration for break-glass access to a critical server. The access should be temporary, approved, and fully auditable. Which solution meets these requirements?

A company has several service accounts with high privileges. The security team wants to reduce the risk of these credentials being used by attackers. Which practice is most effective?

Keep studying — Credential and Privilege Management