Administrative Access GDAT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization is enforcing MFA for all administrative access. A helpdesk admin uses a legacy VPN client that does not support modern authentication protocols. The admin must still be able to perform remote administrative tasks securely. What is the most appropriate action?

   • ADisable the admin's remote access until the VPN client is upgraded.
   • BReplace the legacy VPN client with a modern one that supports SAML or OIDC, then enforce MFA on the VPN.
   • CCreate a separate AD account for the admin without MFA and use it only for VPN access.
   • DAllow the admin to use a personal device with a token generator to authenticate to the VPN.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is enforcing MFA for all administrative access. The helpdesk team uses a shared workstation to manage servers via RDP. Which MFA approach is most appropriate for this scenario?

   • AUse a shared hardware token stored at the workstation for all admins to use.
   • BRequire MFA only on the shared workstation's local login, not on the RDP session.
   • CRely on the RDP session's network-level authentication (NLA) as a form of MFA.
   • DRequire MFA on the administrative account itself, using a hardware token assigned to each individual admin.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security audit reveals that a service account is a member of the Domain Admins group and is used by a web application to connect to a database. What is the primary risk associated with this configuration?

   • AThe service account cannot be monitored because it is not a user account.
   • BThe service account password is likely weak because it is used by an application.
   • CThe service account will expire and cause an outage.
   • DThe service account has far more privileges than needed, increasing the impact if compromised.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization wants to ensure that administrative access is reviewed regularly and revoked promptly when employees leave. Which policy and control combination is most effective?

   • ASet all administrative accounts to expire every 90 days and require re-request.
   • BManually remove access when the manager notifies IT, and review access annually.
   • CRely on the employee's manager to change passwords after departure.
   • DAutomate the deprovisioning of accounts from HR data and require a quarterly recertification of all administrative access.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security engineer needs to allow a support technician to reset passwords for a specific OU only, and only during business hours. The technician should not have permanent rights. Which solution should the engineer implement?

   • AConfigure a just-in-time role in a PAM solution that grants the technician the necessary permissions for a limited time window, with MFA required for activation.
   • BAdd the technician to the Domain Admins group and rely on group policy to restrict logon hours.
   • CCreate a service account with the required permissions and give the technician the password to use when needed.
   • DDelegate the 'Reset password' permission on the OU and leave the delegation permanent.
   Reveal Solution Discussion Select an answer first