hardMultiple Choice
CISSP Practice Question: A security analyst discovers that a service…
A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?
⚠ Common exam trap
The trap here is choosing a 'compensating control' (long password, gMSA, disable-and-recreate) that sounds secure but does not actually work for a legacy app that cannot support modern authentication — CISSP expects you to pick the option that removes the risk rather than patches around it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decommission the legacy application and migrate to a modern alternative that supports secure authentication
The most secure long-term approach is to eliminate the risky legacy dependency entirely by decommissioning the application and migrating to a modern alternative that supports secure authentication such as Kerberos, OAuth, or certificate-based auth. This removes the need for a standing domain-admin service account with a five-year-old password, which is a severe lateral-movement and credential-theft risk. Until the application is retired, no compensating control fully neutralizes the exposure of a privileged, stale credential.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Convert the account to a group Managed Service Account (gMSA)
Why it's wrong here
Converting to a gMSA is generally a strong security practice for modern services, as it automates password management and simplifies service principal name (SPN) management. However, gMSAs are not compatible with many legacy applications that lack the necessary API support to retrieve credentials from Active Directory. Furthermore, implementing gMSAs requires a Windows Server 2012 or higher domain functional level, which might not be met in environments still running legacy applications. This makes it an impractical solution for the described scenario.
- ✗
Set a very long, complex password and store it in a password manager
Why it's wrong here
While setting a long, complex password and storing it in a password manager improves the *strength* of the credential, it fundamentally remains a static password. This approach does not address the critical security requirement of automated, regular password rotation, leaving the account vulnerable to compromise if the password is ever exposed or brute-forced over a long period. Manual rotation is prone to human error and inconsistency, failing to mitigate the inherent risks of static service credentials.
- ✓
Decommission the legacy application and migrate to a modern alternative that supports secure authentication
Why this is correct
Decommissioning the legacy application and migrating to a modern alternative is the most comprehensive and effective long-term solution. This approach eliminates the underlying security risk entirely by removing the need for a problematic service account that relies on insecure authentication methods. Modern applications typically support robust authentication mechanisms like OAuth 2.0, OpenID Connect, or integrated Windows authentication, which significantly enhance security posture and reduce the attack surface associated with static credentials. This strategy proactively addresses the root cause of the vulnerability.
- ✗
Disable the account and create a new service account with limited privileges
Why it's wrong here
Disabling the existing service account would immediately break the legacy application, as it relies on that specific account for its operations. While creating a new service account with limited privileges is a good security principle, legacy applications often have hardcoded dependencies or require elevated permissions, such as Domain Admin, to function correctly due to poor design or lack of least privilege implementation. Therefore, simply creating a new account with fewer privileges might not resolve the application's functional requirements, or the new account might still necessitate excessive permissions, failing to mitigate the core risk.
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Compensating control
A compensating control is a security measure implemented to reduce risk when a primary control cannot be used or is insufficient.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.