Technical interview guide

Privileged Access Management

Extra controls around high-risk, elevated-privilege accounts — the accounts that matter most if compromised.

Read: 45 min
Practice MCQs: 25
Interview QA: 25
Edition: v5
Editorial status: Reviewed
Relevant for: Identity and Access Management (IAM) Engineer

Scope: NIST SP 800-53 Rev. 5 and SP 800-207, NIST SP 800-63B-4, current CISA, AWS, Microsoft Entra PIM, Google Cloud PAM, Kubernetes, IETF, OWASP, and sudo guidance reviewed 2026-09-04.

Interview QA

Treat each question like a live interview question: answer out loud first (structure, assumptions, tradeoffs), then open the model answer to spot gaps and rehearse a tighter follow-up.

Curated: 2026-10-05 · Written: 2026-09-09 · Reviewed: 2026-10-03

QA-1

Design a just-in-time elevation workflow.

QA-2

Combine just-in-time and just-enough administration.

QA-3

Design separate administrator identities safely.

QA-4

Build a privileged-access approval model.

QA-5

Issue credentials for an approved privileged session.

QA-6

Integrate a vault without mistaking it for complete PAM.

QA-7

Control a legacy system that supports one shared admin account.

QA-8

Design privileged session recording and monitoring.

QA-9

Design and test break-glass access.

QA-10

Threat-model the PAM control plane.

QA-11

Implement end-to-end privileged-access revocation.

QA-12

Design PAM controls for workloads and automation.

QA-13

Prevent confused-deputy and target-substitution attacks.

QA-14

Implement command-level privileged policy.

QA-15

Design third-party privileged support access.

QA-16

Run a privileged-access recertification.

QA-17

Apply authentication and step-up to privileged operations.

QA-18

Secure PAM connectors, agents, and target integrations.

QA-19

Respond to suspected privileged-session compromise.

QA-20

Design safe delegation and impersonation.

QA-21

Design degraded-mode behavior for PAM dependencies.

QA-22

Define PAM security and reliability metrics.

QA-23

Control irreducible root and tenant-owner credentials.

QA-24

Design privileged joiner-mover-leaver controls.

QA-25