hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security analyst discovers that a service…
A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decommission the legacy application and migrate to a modern alternative that supports secure authentication
The most secure approach because it eliminates the risk by decommissioning the legacy application and migrating to a modern alternative that supports secure authentication protocols such as Kerberos or modern federation. This removes the need for a highly privileged service account with a non-expiring password and resolves the underlying issue. Option A is not suitable because group Managed Service Accounts (gMSAs) require the application to support modern authentication and the system must meet domain functional level requirements. Option B does not address the lack of automatic password rotation and still leaves a static credential vulnerable to theft. Option D would break the application immediately without a solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Convert the account to a group Managed Service Account (gMSA)
Why it's wrong here
Converting to a gMSA is generally a strong security practice for modern services, as it automates password management and simplifies service principal name (SPN) management. However, gMSAs are not compatible with many legacy applications that lack the necessary API support to retrieve credentials from Active Directory. Furthermore, implementing gMSAs requires a Windows Server 2012 or higher domain functional level, which might not be met in environments still running legacy applications. This makes it an impractical solution for the described scenario.
- ✗
Set a very long, complex password and store it in a password manager
Why it's wrong here
While setting a long, complex password and storing it in a password manager improves the *strength* of the credential, it fundamentally remains a static password. This approach does not address the critical security requirement of automated, regular password rotation, leaving the account vulnerable to compromise if the password is ever exposed or brute-forced over a long period. Manual rotation is prone to human error and inconsistency, failing to mitigate the inherent risks of static service credentials.
- ✓
Decommission the legacy application and migrate to a modern alternative that supports secure authentication
Why this is correct
Decommissioning the legacy application and migrating to a modern alternative is the most comprehensive and effective long-term solution. This approach eliminates the underlying security risk entirely by removing the need for a problematic service account that relies on insecure authentication methods. Modern applications typically support robust authentication mechanisms like OAuth 2.0, OpenID Connect, or integrated Windows authentication, which significantly enhance security posture and reduce the attack surface associated with static credentials. This strategy proactively addresses the root cause of the vulnerability.
- ✗
Disable the account and create a new service account with limited privileges
Why it's wrong here
Disabling the existing service account would immediately break the legacy application, as it relies on that specific account for its operations. While creating a new service account with limited privileges is a good security principle, legacy applications often have hardcoded dependencies or require elevated permissions, such as Domain Admin, to function correctly due to poor design or lack of least privilege implementation. Therefore, simply creating a new account with fewer privileges might not resolve the application's functional requirements, or the new account might still necessitate excessive permissions, failing to mitigate the core risk.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.