SY0-701 Question 75
Single answerSupply chain: Managed service providers (MSPs) , Vendors , SuppliersA healthcare company uses a managed service provider (MSP) to administer firewalls, endpoint protection, and remote support for hundreds of workstations. During a security review, the company discovers the MSP uses a single remote administration platform and shared privileged accounts to manage multiple customers. Leadership is most concerned about a compromise at the MSP being used to pivot into the healthcare company's environment or another customer's breach affecting them. Which action would BEST reduce this supply chain risk while still allowing the MSP to provide support?
- A
Require the MSP to use dedicated, customer-specific administrative accounts integrated with MFA and restrict remote access to approved management paths
- B
Ask the MSP to sign a statement confirming it has never experienced a breach involving another customer
- C
Move all workstation support duties from the MSP to an internal help desk but continue allowing the MSP to manage firewalls with the same shared accounts
- D
Require the MSP to increase the password length on its shared administrator account and rotate the password quarterly
Show answer and explanation
Correct answer: A
Explanation
The key issue is third-party supply chain risk introduced by an MSP that uses shared privileged access and common management tooling across multiple customers. In Security+ terms, this is a vendor/MSP risk management problem involving least privilege, segmentation, identity and access management, and the danger of transitive trust. The most effective control is to reduce blast radius through customer-specific accounts, strong authentication such as MFA, and constrained administrative access paths. This approach supports accountability, limits cross-tenant exposure, and better contains compromise if the MSP is breached. Best practices from sources such as NIST Cybersecurity Framework supply chain risk management guidance and NIST SP 800-161 emphasize managing supplier relationships through contractual requirements, access restrictions, and verification of security controls. Shared administrative accounts are especially problematic because they undermine auditing and increase the impact of a compromise affecting the MSP, vendor, or supplier.
- A. Correct.
This is the best answer because it directly addresses the supply chain and third-party access risk created by shared privileged accounts and broad remote administration. Using dedicated customer-specific accounts improves tenant isolation, supports accountability and logging, and reduces the chance that compromise of one customer's credentials or session can be reused against another. Requiring MFA and limiting access to approved management paths further reduces the attack surface and aligns with least privilege, segmentation, and third-party risk management best practices.
- B. Incorrect.
This is incorrect because an attestation about past breaches does not materially reduce current technical risk. Even if the MSP has not disclosed a prior breach, the underlying issue is weak isolation and shared privileged access across customers. Security reviews should rely on enforceable controls, contracts, audit rights, and technical safeguards rather than informal assurances.
- C. Incorrect.
This is incorrect because it only partially changes the support model and leaves the highest-risk condition in place: the MSP still manages critical infrastructure using the same shared accounts. Firewalls are high-value assets, and continued use of shared privileged credentials preserves the opportunity for lateral movement or cross-customer compromise. The scenario asks for the best way to reduce supply chain risk while still allowing MSP support, not merely shifting some duties internally.
- D. Incorrect.
This is incorrect because stronger passwords and periodic rotation are weaker compensating measures when the core problem is account sharing and lack of customer isolation. Shared accounts reduce nonrepudiation and make it difficult to tie actions to a specific administrator. Quarterly rotation may help somewhat, but it does not prevent an attacker who compromises the MSP's platform or shared credentials from accessing multiple customers.