What is a break-glass account and when is it used?

• A. A standard, non-privileged user account with restricted access.
• B. An emergency highly privileged account with strict controls; used during outages and requires dual control.
• C. A service account used to run automated tasks with background privileges.
• D. A guest account with temporary permissions.

Answer: (B)

Break-glass access is an emergency, highly privileged access to systems that is only used when normal access paths aren’t available. It’s designed to let you act quickly to restore or maintain critical services during outages or severe incidents, but it has stringent safeguards to prevent abuse. Those safeguards typically include dual control (two authorized people must approve or be present), strict logging and auditing, time-bound or session-limited use, and immediate revocation after the task is done. This combination—emergency need plus tight controls—captures the essence of break-glass.

So the best answer describes an emergency highly privileged account with strict controls that’s used during outages and requires dual control. The other options describe standard or service or guest accounts, which do not fit the emergency, tightly controlled access scenario.