Server Infrastructure Management

Question 2

What is the purpose of using a tiered access model for privileged access?

Answer 2

To isolate and build layers of containment between the Windows systems through the directory structure; prevent escalation across tiers by provisioning access to privileged identities only to the tier they need access to

Question 3

How is a tiered access model implemented?

Answer 3

Through AD OU’s; A hierarchal design that is divided into three or more parent containers

Question 4

What is the most important tier in a tiered access model?

Answer 4

Tier 0; contains the systems, accounts, and security groups of the highest security concern, such as domain controllers (DCs), Azure AD Connect servers, and identity management systems;

Question 5

How should access to tier 0 in a tiered access model be secured?

Answer 5

Deploy a PAM solution to include password rotation, an approval request flow
process, auditing logs, session recording or Azure PIM if in the cloud

Question 6

What would be considered tier 1 in a tiered access model?

Answer 6

Contains systems such as business servers, file servers, web application servers, and database servers.

Question 7

How should access to tier 1 in a tiered access model be secured?

Answer 7

Use PAM or PIM; Using a top down approach, admins with access to tier 0 will be able to access tier 1

Question 8

How should the OUs be structured in a tiered access model?

Answer 8

When architecting the organizational structure of the tiered model, create a child OU nested under the tier 1 parent and label them by business unit (BU), application name, or function to create
a descriptive structure.

Question 9

What does tier 2 in a tiered access model contain?

Answer 9

Common devices; end-user machines

Question 10

What are additional best practices to secure access to windows resources?

Answer 10

• For RDP and interactive logons, allowed sources should be restricted to a privileged
  access workstation (PAW), trusted device, or isolated management environment,
  preferably requiring a form of passwordless or biometric authentication, or multi-factor authentication (MFA).
• Network restrictions should be considered for tier 0 access scenarios by restricting
  RDP connections and other management ports to sources from known virtual
  networks (VNets), subnets, and workstations.

Question 11

What are best practices to secure access?

Answer 11

• Enforce/require MFA for all cloud resrouces and implement MFA tool for on prem
• Deploy a PAM or PIM for Just-In-Time access
• Efficient account provisioning/deprovisioning - automation
• Monitor/Audit privileged accounts
• Separate administrative accounts with regular users’ accounts and limit number of admins
• Limit access to email and internet browsing when applicable from privileged
  systems.
• Enforce strict fine-grained password policies on administrative accounts.
• Limit the amount of emergency “backdoor” accounts
• Ensure any changes to the environment go through an approval process by a change
  advisory board.