Access Control and Privilege Management
What the exam tests
This domain covers authentication, authorization, and the credential hygiene that determines how far an intruder travels after the first foothold.
Core rules
- AAA means identification, authentication, authorization, and accounting. Logging privileged actions is part of the control, not an optional extra.
- Least privilege and separation of duties: a domain admin account should not read email or browse the web. Use tiered administrative accounts so Tier 0 credentials never cross into Tier 1 or Tier 2 systems.
- RBAC scales, ABAC adds context such as device compliance, time, and location. Privilege sprawl usually hides in nested group membership, not in direct assignments.
- MFA stops credential replay but not adversary-in-the-middle phishing or stolen session tokens. Pair it with conditional access and token protection.
- PAM vaults shared credentials, brokers sessions, and grants just-in-time elevation with approval and automatic expiry.
- Service accounts should be group managed where possible, carry unnecessary SPNs removed, rotate passwords, and never hold interactive logon rights or Domain Admin.
Worked example
Finding: a service account holds an SPN, allows RC4 Kerberos only, has a four-year-old password, is a member of Domain Admins, and runs logon scripts on 40 workstations. Reasoning: the SPN makes it Kerberoastable, RC4 makes the resulting hash cheap to crack, Domain Admin turns a cracked hash into Tier 0 compromise, and workstation logons expose the credential to every host it touches. Remediation order: strip Domain Admin membership and interactive logon rights, migrate to a group managed service account, rotate the password twice, reset krbtgt if cracking is plausible, then rescan.
Traps
- Treating MFA as phishing-proof.
- Reusing one local administrator password across the fleet without LAPS.
- Assuming Domain Users is harmless; it is the default path to enumeration.
- Leaving passwords that never expire on privileged or service accounts.