Tap to reveal what to do
- Do this first
- Why
- Control reference
- Common mistake
Keys: F or Space flip · → or G got it · ← or R review again · S shuffle. On a phone, swipe right or left.
You are all caught up
Cards you marked “Got it” come back after a few days so they stick. Cards to review again return sooner.
Topic mastery
Key concepts
- Least privilege
- People and systems get only the access they need, for as long as they need it.
- Privileged accounts
- Admin, root, DBA, service and break-glass accounts. Fewer, named, vaulted and monitored.
- Joiner, mover, leaver
- Access is granted on approval, changed on role change and removed promptly on exit.
- Segregation of duties
- No one person can request, approve and perform a sensitive change alone.
- PAM controls
- Vault and rotate credentials, require MFA, elevate just in time and record privileged sessions.
How an auditor tests it
- Reconcile the HR leaver list against active accounts and recent logins.
- Sample privileged accounts and trace each to a named owner and a current business need.
- Reperform a sample of the access review and check that reviewers actually removed access.
- Walk the privileged login path and confirm MFA is enforced at the privileged step, not just the VPN.
- Trace high-risk privileged sessions to approved change tickets.
Evidence examples
- Privileged account inventory with owners
- Access review sign-offs with timestamps and removals
- Vault checkout and rotation logs
- MFA policy configuration exports
- Leaver tickets and account disable dates
Interview angles
- How would you test whether an access review really works?
- What would you do with a shared admin account you cannot retire?
- Why is MFA on the VPN not enough for admins?
- How do you handle service accounts that cannot be rotated?