Engineers occasionally need administrator rights on production servers to resolve change tickets. The security team wants no standing admin access, with elevation granted only for an approved ticket and removed automatically when the work window ends. Which access control approach BEST fits?
Select an answer to reveal the explanation.
Short Explanation
Just-in-time access is the hotel key card that works only for your stay and dies at checkout. You get admin rights when an approved ticket says so, and they vanish when the window closes. Business-hours access sounds similar, but that's standing access five days a week - the trap.
Full Explanation
Just-in-time (JIT) access eliminates standing privileges by granting elevated rights on demand, tied to a justification such as an approved change ticket, for a limited duration, and then revoking them automatically. This shrinks the window in which a compromised engineer account could be misused for administrative actions and produces a clear audit trail linking each elevation to a business reason. Time-based access restricts when an entitlement can be used, for example during business hours, but the entitlement itself persists every weekday regardless of whether any approved work exists, so it is still standing access. Adding engineers to a permanent administrators group is precisely the standing privilege the requirement forbids; role membership persists until someone removes it. Discretionary access lets resource owners grant rights at their own judgment, which provides neither consistent approval tied to tickets nor automatic expiry. Exam caveat: JIT is frequently implemented through privileged access management tools that broker and record elevated sessions, and it pairs naturally with least privilege. Operational check: request elevation against a test ticket, confirm the rights appear only after approval, and verify they are removed at the window's end without manual action.