A civic tiered-administration model exists on paper, yet operators routinely use Domain Admin credentials inside ordinary email and browsing sessions. What concept should the finding stress?
Select an answer to reveal the explanation.
Short Explanation
Tiering is the clean-room rule: vault keys stay out of the break room. Logging into Outlook as Domain Admin drags those keys through phishing and malware land. Keep privileged work on hardened, dedicated paths.
Full Explanation
Privileged access models expect high-value credentials to be used only on appropriately hardened, higher-trust systems. When civic operators routinely use Domain Admin inside ordinary email and browsing sessions, paper tiering fails in practice: phishing and malware on daily workstations can steal directory-control tokens. The finding should stress that privileged credentials must not ride lower-trust systems that serve mail and web for municipal staff.
Domain Admin sessions on email clients do not improve auditability of privileged work; they expand exposure and muddy separation of duties. Tiering applies to interactive administrators as much as service accounts—limiting the model to services alone misses the dominant human-operator risk. Email clients do not automatically isolate Domain Admin tokens from phishing risk on the same host.
Exam caveat: tiered administration is an operational discipline (where you log on and what you do there), not merely an OU diagram. CPTS AD hygiene findings should call out practice-versus-policy gaps that enable credential theft.
Operational check: sample recent Domain Admin interactive logons, identify any on mail/browsing workstations, migrate privileged work to PAWs or jump hosts, and verify SIEM detections for Tier-0 logons on non-privileged civic endpoints.