Which option best describes the defining purpose of a privileged access management platform within an enterprise identity programme?
- AIt serves as the primary identity provider for all employee and customer sign-ins so that a single console enforces password complexity and lockout policy across every application in the estate.
- BIt brokers, vaults, and audits access to privileged accounts and high-impact systems, typically by issuing short-lived credentials, recording sessions, and requiring just-in-time approval rather than allowing standing administrative access. Correct
- CIt replaces multi-factor authentication for administrators by binding a hardware token to each privileged account, allowing the holder to bypass session recording and approval workflows during routine maintenance work.
- DIt performs lifecycle provisioning and deprovisioning of ordinary user accounts so that joiners, movers, and leavers are reflected promptly across human resources, directory, and downstream business applications.
Why A is wrong: Tempting because PAM platforms do handle credentials, but acting as the general workforce or customer identity provider is the job of a standard IdP, not of a privileged access management tool.
Why B is correct: Correct. PAM is specifically aimed at the administrative tier: vaulting credentials, brokering connections, granting just-in-time elevation, and recording sessions for forensic and audit purposes.
Why C is wrong: Plausible to a candidate who equates strong authentication with privileged access, but PAM augments MFA rather than replacing it, and bypassing recording or approval defeats the entire control objective.
Why D is wrong: Plausible because lifecycle work is part of identity, but joiner-mover-leaver provisioning is the role of an identity governance and administration platform, not of a PAM tool.