Remediating Excessive Domain Admin Rights With PAM and RBAC
A security audit of an organization revealed that most of the IT staff members have domain administrator credentials and do not change the passwords regularly. Which of the following solutions should the security team propose to resolve the findings in the most complete way?
Community Votes
50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The phrase 'most complete way' points to a control that keeps working after the cleanup rather than a one-time change. A PAM vault rotates privileged passwords automatically and RBAC restricts who may obtain them, so both audit findings are addressed continuously instead of once.
The audit produced two findings: too many IT staff hold domain administrator credentials, and those credentials are never rotated. A privileged access management vault combined with role-based access control resolves both at once, because the vault removes standing knowledge of the passwords and rotates them automatically while RBAC limits retrieval to staff whose role requires it.
Choosing the option that removes administrators and rotates passwords because it names both findings literally. That is a point-in-time cleanup with no ongoing control, whereas a PAM vault keeps rotating credentials and RBAC keeps restricting access.
Community Discussion (19 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A privileged access management vault stores domain administrator credentials centrally so staff retrieve them under policy instead of holding them, and it rotates those credentials on a schedule without human intervention, which directly answers the finding that passwords are never changed. Layering role-based access control on top means only roles that genuinely require privileged access can obtain the credentials, so the finding that most IT staff hold domain administrator credentials is resolved by design rather than by a one-off review. The same solution also adds session monitoring and audit trails, which is why it is the most complete remediation of the two findings.Why the Other Options Are Wrong
A group policy enforcing rotation on domain administrator credentials addresses only the password finding and leaves the number of administrators untouched, so the more serious finding survives. Reviewing the administrators group, removing unneeded members, and rotating all passwords resolves both findings at a single point in time but installs no ongoing control, so access can re-accumulate and the rotated passwords can age again. Integrating the administrator group with an identity provider and requiring SSO with MFA strengthens authentication, yet it neither reduces how many people hold domain administrator rights nor imposes rotation on those credentials.Community Comment Notes
The community split almost evenly between removing unnecessary administrators and deploying a PAM vault with RBAC, with several voters changing sides after reading the exchange. klinkklonk argued that rotating passwords for people whose privileges are being removed makes no sense and called the password wording a trap, while caseymd85 and CircaG held that the PAM option leaves the excess administrators in place. russian and 65333d6 countered that a PAM vault rotates privileged passwords automatically and that the phrase 'most complete way' favours the comprehensive control, which is the reading the answer key follows.Official Reference
Exam Strategy
When a stem says 'most complete way', prefer the answer that covers both findings and keeps enforcing them over time. Treat the passwords and access lists named in the question as traps that pull you toward the narrow one-time option, and check whether the broader control also handles them.
Frequently Asked Questions
Why is removing unnecessary administrators and rotating all passwords not the most complete fix?
It is a one-time cleanup with no ongoing control, so excess administrative access can return and the rotated passwords will age, whereas a PAM vault keeps rotating and RBAC keeps restricting access.
How does a PAM vault address the finding that domain administrator passwords are never changed?
PAM stores the credentials centrally and rotates them on a defined schedule without manual effort, so staff never need to know or reuse the underlying password.