A manager asks why an organisation would route all administrator logins through a dedicated privileged access management system that brokers the session and records what the administrator does. Which statement best explains the primary security purpose of that arrangement?
- AIt encrypts network traffic so that administrator passwords cannot be intercepted between the client and the server
- BIt replaces the need for least privilege by giving administrators one convenient account for every system
- CIt controls, monitors, and records the use of high-risk privileged accounts so their activity is governed and auditable Correct
- DIt guarantees that administrators can never make configuration mistakes while managing production systems
Why A is wrong: Encrypting traffic protects credentials in transit and is worthwhile, but it is not the primary purpose of brokering and recording privileged sessions.
Why B is wrong: This is the opposite of good practice; privileged access management supports least privilege rather than replacing it, and consolidating power into one account would increase risk.
Why C is correct: This states the core aim of privileged access management: to broker, constrain, and log the use of powerful accounts so their high-risk activity is accountable and reviewable.
Why D is wrong: No system can guarantee error-free administration; privileged access management reduces and records risk but does not prevent all mistakes, so this overstates its function.