SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Keep the shared password but store it in a spreadsheet with restricted access.

  Why it's wrong here

  Storing the shared local administrator password in a restricted spreadsheet does not eliminate the fundamental problem of credential reuse across the entire server fleet. If an attacker compromises any one server or gains any read access to that spreadsheet, they immediately have the same administrative password for every Windows server built from the same image. Access control lists on a spreadsheet also provide no technical enforcement at the operating system level, and the spreadsheet itself becomes a high-value target for theft or exfiltration. This approach simply trades one management problem for another without reducing the blast radius of a single credential compromise.

• ✓

  Implement a tool that automatically sets unique local admin passwords on each server.

  Why this is correct

  This is the best hardening change because shared local administrator passwords create an easy lateral-movement path if one server or credential is exposed. A password management solution that generates unique local admin passwords reduces blast radius while preserving administrative access. It also supports safer operational management because the passwords can still be retrieved or rotated through controlled processes instead of being duplicated across systems.

• ✗

  Remove all administrator accounts from the servers.

  Why it's wrong here

  Removing all administrator accounts from the servers is operationally infeasible because routine patching, driver installations, service configuration, and incident response all require privileged local access. The built-in Administrator account cannot be fully removed from Windows—it can only be disabled—and an attacker with SYSTEM privileges can re-enable it or create a hidden backdoor account regardless of your password policy. Even if you deleted every visible admin user, the servers would still have a default administrative context (e.g., via LocalSystem) that can be abused, so this change neither solves the shared-credential problem nor improves security in practice. It would instead break your own ability to manage the systems safely.

• ✗

  Change the password manually once a year on one server only.

  Why it's wrong here

  Changing the local administrator password manually on a single server once a year leaves every other server in the fleet still using the original shared password from the gold image. An attacker who already has a foothold on any one of those other servers can still move laterally to all of them, including the one you changed, because the old password remains valid on the rest. The annual interval is also far too long, especially since Windows Server does not enforce local account password rotation by default, and a manual process is prone to missed systems. This approach addresses the symptom on only one host while ignoring the systemic risk of identical credentials across many machines.

Go deeper

Related to this question