PAM, JIT, JEA, and Service Accounts

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

PAM, JIT, JEA, and Service Accounts

Key Takeaways Explain This Topic AI

Privileged access management reduces standing administrative access, vaults secrets, and records high-risk actions.

Just-in-time access grants privilege only for a limited, approved window, then auto-revokes it.

Just-enough administration limits privileged users to the specific commands needed for the task.

Service accounts need a named owner, scoped permissions, credential rotation, vaulting, and behavioral monitoring.

Shared administrator accounts destroy accountability and should be replaced with named accounts plus elevation controls.

Last updated: June 2026

Why Privileged Accounts Are Different

Privileged accounts can change security settings, read sensitive data, create users, disable logs, or deploy code. A single compromise can cascade across an entire domain. Privileged access management (PAM) is the discipline of requesting, approving, limiting, monitoring, and revoking privileged access. SY0-701 treats PAM as the answer whenever a scenario describes standing admin rights, a shared root password, or an over-permissioned service account.

Key Concepts

• Term Meaning Security value
• PAM Controls governing privileged account use Reduces abuse, improves accountability
• Just-in-time (JIT) Privilege granted for a limited duration Eliminates standing privilege
• Just-enough administration (JEA) Privilege scoped to specific actions Shrinks blast radius
• Credential vault Secure storage and checkout of secrets Protects admin passwords and keys
• Ephemeral credentials One-time, short-lived secrets No long-lived password to steal
• Session recording Capture of privileged activity Supports investigation and deterrence

A useful mental model: JIT controls when and how long ; JEA controls what you may do. Strong PAM combines both with MFA, an approval workflow, and automatic revocation.

Scenario: Emergency Database Maintenance

A database administrator (DBA) must apply an emergency index change to production. Without PAM the DBA holds permanent admin rights; if that account is phished, the attacker owns production immediately. With PAM the DBA submits a request tied to an incident ticket. The system checks the on-call schedule, forces MFA, grants the db-maint role for 60 minutes , records the session, and strips the role when the window expires. JEA narrows the grant to database maintenance commands instead of full operating-system administration, so the elevated session cannot pivot to the host.

Example privileged event trail: 2026-06-14T15:04:11Z pam request_id=PR-8842 user=dbell target=db-prod-03 role=db-maint approver=ltan duration=60m status=approved

• 2026-06-14T15:06:03Z pam request_id=PR-8842 user=dbell mfa=success session=started source_ip=10.40.8.25
• 2026-06-14T15:42:18Z pam request_id=PR-8842 command="ALTER INDEX IX_CLAIMS_REBUILD" result=success
• 2026-06-14T16:06:04Z pam request_id=PR-8842 session=ended elevation=revoked

The load-bearing fields are identity, approval, target, role, start time, actions, outcome, and revocation. If a question asks what makes the change auditable, point to this chain, not to the firewall or to encryption.

Service Accounts

Service accounts run applications, scheduled jobs, integrations, and machine-to-machine tasks. They are easy to overlook because no human sits at the keyboard, which is exactly why attackers prize them.

• Service account control Why it matters
• Named human owner Someone must approve use and answer alerts
• No interactive login Prevents reuse as a normal human login
• Least privilege Limits damage if the app is compromised
• Secret rotation Reduces the value of a leaked password or key
• Vaulting Removes hardcoded secrets from scripts and repos
• Behavioral monitoring Detects unusual source host, time, or action

Managed service identities and gMSA (group managed service accounts) that rotate passwords automatically are the modern improvement over hand-set, never-changed passwords.

Common Traps

One shared "admin" account for the entire IT team (zero accountability).

Permanent domain administrator rights for occasional troubleshooting.

Hardcoding service-account passwords in scripts or source control.

Forgetting to disable a contractor's privileged account after the project ends.

Monitoring failed human logins while ignoring service-account behavior.

Exam Focus

When asked for the best way to reduce risk from privileged accounts, choose the option that reduces standing privilege, scopes the permission, enforces MFA, requires approval, logs the session, and auto-revokes . For service accounts, choose owner assignment, least privilege, vaulting, and rotation. "Permanent admin" and "shared password" answers are distractors.

Break-Glass and Tiered Administration

Every PAM program still needs break-glass (emergency) accounts for the moment the IdP or PAM portal itself is down. The exam-correct way to handle them: keep credentials sealed in a vault, alert on every checkout, force a password rotation after each use, and review the access afterward. A break-glass account that is used routinely is no longer an emergency account, it is an unmanaged super-user.

Tiered administration further limits blast radius by separating admin duties into tiers, so a workstation-support admin cannot log into a domain controller. This blocks credential-theft pivoting , where an attacker harvests a high-tier credential from a low-tier machine. Pair tiering with privileged access workstations (PAWs) , hardened jump hosts dedicated to administrative work and isolated from email and web browsing.

Secrets Management in Pipelines

Modern environments push secrets into CI/CD pipelines and containers. SY0-701 expects you to recognize that hardcoded API keys in a Git repository are a finding; the fix is a secrets manager or vault that injects short-lived, ephemeral credentials at runtime and never persists them to disk or source control. Rotating a leaked key and scanning history for further exposure are the correct follow-ups.

Decision Checklist

Is the access standing or time-boxed? Prefer time-boxed JIT.

Is the scope full-admin or task-scoped? Prefer JEA.

Is the secret human-set and static or vaulted and rotated? Prefer vaulted.

Is the actor a named user or a shared login? Prefer named with elevation.

Is the session recorded and revocable? It must be both.