A security team deploys a new scanning solution that requires root, domain administrator, and local...

A Privileged Access Management (PAM) solution provides the strongest control for credentials with root, domain administrator, and local administrative authority. Vulnerability scanners frequently require elevated permissions for credentialed assessments, but permanently exposing those credentials to scanning infrastructure creates substantial risk. If compromised, the scanner could provide an attacker with privileged access across a large portion of the environment.

PAM systems can protect privileged credentials through centralized vaulting, controlled checkout, tokenized or brokered authentication, rotation, session restrictions, auditing, and time-limited privilege. This aligns with the principle of least privilege, under which entities should receive only the access necessary to perform assigned functions. NIST defines least privilege in precisely this manner and applies the principle to privileged accounts.

Single sign-on improves authentication convenience but does not adequately secure highly privileged scanning credentials. A simple one-time password adds authentication assurance but lacks the credential governance and lifecycle controls provided by PAM. Agentless scanning changes scanner architecture but does not solve the underlying privileged-access requirement.

The strongest design is therefore to place high-impact administrative credentials under dedicated privileged-access controls rather than treating them as ordinary service credentials.

Study Guide Reference: Vulnerability Management → Credentialed Scanning → Scanner Permissions → PAM → Least Privilege → Credential Vaulting and Rotation.