Practice vocabulary for Privileged Access Management including just-in-time access, privilege escalation, MFA for admin accounts, CyberArk, break-glass accounts, and time-limited access.
0 / 15 completed
1 / 15
'Just-in-time (JIT) access' means that privileged permissions are _____.
JIT access eliminates standing privileges — admin access is requested, approved, and granted for a limited time window, then automatically revoked, reducing the attack surface.
2 / 15
'Privilege escalation' in a security context refers to _____.
Privilege escalation is a security attack where an actor exploits a vulnerability or misconfiguration to obtain permissions beyond those they were granted — a key risk PAM systems are designed to prevent.
3 / 15
When an admin account requires both MFA and manager approval before granting access, this is an example of _____.
Combining MFA with a human approval workflow for admin accounts is a core PAM control — it ensures that privileged access requires both identity verification and business justification.
4 / 15
CyberArk is primarily used for _____.
CyberArk is a leading PAM platform that vaults privileged credentials, enforces JIT access, records privileged sessions, and provides audit trails for compliance.
5 / 15
A 'break-glass account' is a highly privileged emergency account that _____.
A break-glass (or emergency access) account provides a last-resort way to access critical systems when normal authentication is unavailable — its use is tightly monitored and triggers immediate alerts.
6 / 15
Code Review Comment: 'I noticed this script uses the sudo command. While convenient for testing, it's a potential risk if the script is committed to our repository. We should explore alternative methods like temporary elevated privileges or using a dedicated privileged account.' What does this comment primarily address regarding security?
This comment directly concerns the risk of sudo being used in a way that could elevate privileges and potentially compromise the system. The reviewer is highlighting the danger of granting unrestricted access through a script, even temporarily. Options A, C, and D are related to development practices but don't address the specific security issue raised.
7 / 15
Slack Message from Alex: 'Hey team, just deployed a new build with elevated permissions for database updates. Double-check your queries and make sure you're only updating what's necessary! We've implemented stricter access controls to minimize the blast radius.' What does 'blast radius' refer to in this context?
'Blast radius' in this scenario refers to the extent to which a compromised account or privileged access can spread and cause harm. It represents the potential impact – the damage, data loss, or disruption – if an attacker gains control. The message is emphasizing the importance of limiting the consequences of any security incident.
8 / 15
API Response from PAM Server: `{"status": "success", "user": "john.doe", "access_level": "administrator", "duration": "30m", "token": "abcdef123456"}`. What does the 'duration' field in this response indicate?
The 'duration' field specifies the limited timeframe for which the granted privileged access is valid. This is a core component of Just-in-Time (JIT) access management – restricting elevated privileges to only what's needed and for a defined period. The token is for authentication, not duration.
9 / 15
PR Description: 'This commit adds support for temporary privileged access to the staging environment using CyberArk. This allows developers to perform database migrations without impacting production systems. We've configured MFA and require manager approval for all sessions.' What is the primary benefit of utilizing CyberArk in this scenario?
CyberArk is primarily a Privileged Access Management (PAM) solution – it provides centralized control and security for privileged accounts. This PR description highlights its use in managing temporary access to the staging environment, ensuring that developers have elevated permissions safely and securely without directly compromising production systems. The other options represent features of different security tools.
10 / 15
Standup Update from Sarah: 'I'm working on implementing a new process where we use a break-glass account for emergency database restores. This account has extremely limited permissions and is only used in specific, documented scenarios with multi-factor authentication to prevent unauthorized access.' What is the main purpose of a 'break-glass account'?
A 'break-glass account' is designed to be an extremely secure, last-resort account. It's intentionally isolated and has minimal permissions to limit the damage if compromised. Its primary purpose is for emergency situations – like disaster recovery or critical system failures – where immediate access is required but standard security protocols cannot be immediately applied. Option A and B are incorrect because they describe regular administrative accounts.
11 / 15
Code Review Comment: 'I noticed this script uses the sudo command. While convenient for testing, it's a potential risk if the script is committed to our repository. We should explore alternative methods like temporary elevated privileges or using a dedicated privileged account.' What does this comment primarily address regarding security?
This comment directly concerns the risk of sudo being used in a way that could elevate privileges and potentially compromise the system. The reviewer is highlighting the danger of granting unrestricted access through a script, even temporarily. Options A, C, and D are related to development practices but don't address the specific security issue raised.
12 / 15
Slack Message from Alex: 'Hey team, just deployed a new build with elevated permissions for database updates. Double-check your queries and make sure you're only updating what's necessary! We've implemented stricter access controls to minimize the blast radius.' What does 'blast radius' refer to in this context?
'Blast radius' in this scenario refers to the extent to which a compromised account or privileged access can spread and cause harm. It represents the potential impact – the damage, data loss, or disruption – if an attacker gains control. The message is emphasizing the importance of limiting the consequences of any security incident.
13 / 15
API Response from PAM Server: `{"status": "success", "user": "john.doe", "access_level": "administrator", "duration": "30m", "token": "abcdef123456"}`. What does the 'duration' field in this response indicate?
The 'duration' field specifies the limited timeframe for which the granted privileged access is valid. This is a core component of Just-in-Time (JIT) access management – restricting elevated privileges to only what's needed and for a defined period. The token is for authentication, not duration.
14 / 15
PR Description: 'This commit adds support for temporary privileged access to the staging environment using CyberArk. This allows developers to perform database migrations without impacting production systems. We've configured MFA and require manager approval for all sessions.' What is the primary benefit of utilizing CyberArk in this scenario?
CyberArk is primarily a Privileged Access Management (PAM) solution – it provides centralized control and security for privileged accounts. This PR description highlights its use in managing temporary access to the staging environment, ensuring that developers have elevated permissions safely and securely without directly compromising production systems. The other options represent features of different security tools.
15 / 15
Standup Update from Sarah: 'I'm working on implementing a new process where we use a break-glass account for emergency database restores. This account has extremely limited permissions and is only used in specific, documented scenarios with multi-factor authentication to prevent unauthorized access.' What is the main purpose of a 'break-glass account'?
A 'break-glass account' is designed to be an extremely secure, last-resort account. It's intentionally isolated and has minimal permissions to limit the damage if compromised. Its primary purpose is for emergency situations – like disaster recovery or critical system failures – where immediate access is required but standard security protocols cannot be immediately applied. Option A and B are incorrect because they describe regular administrative accounts.
What will I practise in "Privileged Access Management (PAM) Vocabulary"?
Practice vocabulary for Privileged Access Management including just-in-time access, privilege escalation, MFA for admin accounts, CyberArk, break-glass accounts, and time-limited access.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.