200-201 Question 379
Single answerDuring a routine security audit, you discover that several service accounts on a critical server are being used interactively to log into the system. What is the most appropriate action to take to secure these accounts while ensuring continued functionality of the services they support?
- A
Disable interactive logon for the service accounts and assign them strong passwords.
- B
Delete the service accounts and recreate them with new credentials.
- C
Monitor the service accounts’ activity for unusual behavior without making any changes.
- D
Convert the service accounts into administrative accounts to ensure they have adequate privileges.
Show answer and explanation
Correct answer: A
Explanation
Service accounts are intended to support specific applications or services, not to be used for interactive logins. Allowing them to log in interactively increases the risk of exploitation, particularly if their credentials are compromised. Disabling interactive logon while assigning strong passwords ensures that the accounts are only used for their intended purposes, maintaining security and service functionality.
- A. Correct.
Disabling interactive logon for service accounts and assigning strong passwords is the best practice. Service accounts are meant to run specific services or applications, not for interactive logins. This approach secures the accounts while allowing services to function.
- B. Incorrect.
Deleting the service accounts can lead to service disruptions, as the accounts may be tied to critical applications. This is not a practical or secure solution.
- C. Incorrect.
Monitoring service accounts without making changes does not address the risk of their use for unauthorized logins. While monitoring is important, it is not sufficient to mitigate the security concern.
- D. Incorrect.
Converting service accounts into administrative accounts increases the attack surface and violates the principle of least privilege, which is a core cybersecurity practice.