An organization suspects that a compromised admin account was used to create a new backdoor user. The security team needs to determine what actions were performed and by whom. Which monitoring capability is most directly needed?

Centralized collection and correlation of security event logs, including account management events.

Network traffic analysis to detect unusual outbound connections.

Real-time alerting on failed logon attempts.

File integrity monitoring on system32 directory.

A company has a mix of on-premises and cloud resources. The security team wants to centrally manage and rotate administrative credentials for both environments. Which approach is most effective?

Use the same PAM solution but only for cloud resources, and rely on local password changes for on-premises.

Deploy a cloud-based PAM solution that supports both on-premises and cloud credential management and rotation.

Store all credentials in a shared spreadsheet and rotate them manually each month.

Use separate PAM solutions for on-premises and cloud to avoid integration complexity.

What is the main goal of just-in-time (JIT) administration?

To eliminate the need for monitoring admin activity.

To simplify the password rotation process.

To grant elevated privileges only for the duration of a specific task.

To grant permanent elevated privileges to all administrators.

What does just-enough administration (JEA) aim to achieve?

Provide temporary access to the domain admin account.

Grant only the minimum permissions required for a specific task.

Grant all permissions to simplify administration.

Eliminate the need for separate admin accounts.

GIAC Defending Advanced Threats

Domain 3Objective 1

Administrative Access GDAT Practice Questions (Page 7)

Part of the Credential and Privilege Management domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 31–35

31application · medium
An organization suspects that a compromised admin account was used to create a new backdoor user. The security team needs to determine what actions were performed and by whom. Which monitoring capability is most directly needed?
Select an answer first
32expert · hard
A company has a mix of on-premises and cloud resources. The security team wants to centrally manage and rotate administrative credentials for both environments. Which approach is most effective?
Select an answer first
33foundation · easy
Which principle of administrative access ensures that a user is granted only the permissions necessary to perform their job functions?
Select an answer first
34foundation · easy
What is the main goal of just-in-time (JIT) administration?
Select an answer first
35foundation · easy
What does just-enough administration (JEA) aim to achieve?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.