Question

A financial services company must allow a small group of database administrators to manage production database servers that reside in an isolated network segment with no direct inbound internet access. Compliance requires that all administrative sessions be individually authenticated, fully recorded, and that credentials for the target databases never be known to the administrators. Which architecture BEST satisfies these requirements?

Accepted Answer

Deploy a privileged access management (PAM) solution with a session-brokering bastion that performs credential injection, session recording, and per-user MFA before proxying connections to the databases

Answer

Provision site-to-site VPN tunnels from each administrator's workstation to the isolated segment and enforce full-disk encryption on the endpoints

Answer

Publish the databases through a reverse proxy with TLS termination and shared service-account credentials stored in a team password vault

Answer

Grant administrators standing domain admin accounts and rely on centralized SIEM log collection to reconstruct their activity after the fact