Question

A financial services company is redesigning its identity architecture after an audit found that 40 domain administrators hold permanent membership in privileged groups, many of whom rarely perform administrative tasks. The security architect must reduce the attack surface associated with standing privileges while still allowing administrators to perform occasional emergency and routine maintenance. Which approach BEST addresses this requirement?

Accepted Answer

Implement just-in-time (JIT) privileged access with time-bound elevation requests, approval workflows, and automatic revocation, backed by session recording

Answer

Move all administrators into a single high-privilege group protected by a longer, more complex password policy and mandatory quarterly rotation

Answer

Deploy multifactor authentication on all administrator accounts and require it at each interactive logon to the domain controllers

Answer

Create dedicated administrative workstations (PAWs) and require administrators to use them for all privileged operations