100-150 Question 284
Select 2A company uses Active Directory (AD) as its centralized identity store. The IT administrator notices an increase in phishing emails targeting employees, with some employees accidentally providing their credentials to malicious websites. Shortly after, several accounts were compromised, and denial-of-service attacks were launched using these accounts. What should the IT administrator implement to improve security and minimize such risks in the future? (Choose two.)
- A
Enforce a strong password complexity policy in Active Directory.
- B
Disable account lockout policies to prevent service interruptions.
- C
Implement multi-factor authentication (MFA) for all users.
- D
Use email filtering solutions to block spam and phishing emails.
- E
Allow users to share credentials across teams for convenience.
Show answer and explanation
Correct answers: A, C
Explanation
To reduce the risk of account compromise and subsequent attacks, the IT administrator should enforce a strong password complexity policy and implement multi-factor authentication (MFA). Strong passwords make it harder for attackers to crack credentials, while MFA adds an extra layer of security by requiring additional authentication factors. These measures directly address the vulnerabilities exploited in the scenario and enhance the overall security of the Active Directory environment.
- A. Correct.
Enforcing a strong password complexity policy makes it harder for attackers to successfully guess or crack user credentials, reducing the risk of compromised accounts.
- B. Incorrect.
Disabling account lockout policies is not recommended because it would allow attackers to repeatedly attempt to guess passwords without any consequences, increasing the risk of a successful breach.
- C. Correct.
Implementing multi-factor authentication (MFA) adds an additional layer of security, requiring users to verify their identity through a second factor even if their credentials are compromised.
- D. Incorrect.
Using email filtering solutions to block spam and phishing emails is a good practice but does not directly mitigate the risk of compromised accounts or improve identity management within Active Directory.
- E. Incorrect.
Allowing users to share credentials increases the risk of unauthorized access and weakens accountability, making it a poor security practice.