Which combination provides the strongest protection for a highly privileged directory role?
Show answer and explanation
Answer: B
Eligibility removes standing privilege, so the account carries no administrative rights until it deliberately activates the role. Approval adds dual control so one person cannot elevate alone, MFA binds the activation to a verified human, and a justification creates a record of intent. A short maximum duration limits the blast radius if the session is hijacked, and recurring access reviews remove eligibility that is no longer justified. Layering these controls follows defence in depth rather than relying on a single gate.
Why the other options are wrong
- A. A permanent active assignment is standing privilege. MFA at sign-in protects the session but the role is always available to be abused if the account is compromised.
- C. A long activation window without approval removes dual control and leaves privileged access available for most of a day after a single request.
- D. Limiting the number of holders reduces exposure but the assignment is still permanent, with no approval, no expiry and no periodic recertification.
Exam tip. Eligible plus approval plus MFA plus short duration plus review is the full stack.