The correct answer is to disable the svc_backup account in Active Directory and notify the backup team to use an alternate account. This action immediately halts the ongoing password spraying attack by revoking the account’s authentication capability across the hybrid infrastructure, including cloud services integrated via Azure AD Connect, without waiting for password changes to propagate. On the CISSP exam, this scenario tests your understanding of the Incident Response phase of containment, specifically the trade-off between speed and operational impact—disabling a service account is faster and more reliable than resetting credentials, which may fail to synchronize in time. A common trap is choosing to change the password first, but that can leave a window for continued attacks due to replication delays. Remember the memory tip: “Disable first, reset later” to prioritize stopping the threat over credential hygiene.
CISSP Security Operations Practice Question
This CISSP practice question tests your understanding of security operations. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization with 500 employees operates a hybrid infrastructure with on-premises Active Directory and cloud-based services (Office 365, Azure). The security team receives an alert from the SIEM showing a high number of failed login attempts for a service account named 'svc_backup' from an external IP address. The account has delegated permissions to back up all domain controllers. The attempts are ongoing and fall below the lockout threshold to avoid detection. The team suspects a targeted password spraying attack. The helpdesk reports no recent password changes for this account. The incident response plan requires containment within 15 minutes. The cloud services are integrated with AD via Azure AD Connect. Which of the following actions BEST contains the attack while minimizing operational impact?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.
Option C is correct because disabling the compromised service account in Active Directory immediately stops the ongoing password spraying attack, preventing further unauthorized access attempts. This action contains the threat within the 15-minute containment window while minimizing operational impact, as the backup team can switch to an alternate account without disrupting critical backup operations. Disabling the account is faster and more reliable than changing the password, which might not propagate immediately to all domain controllers and cloud services via Azure AD Connect.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Block the external IP address at the firewall.
Why it's wrong here
Attacker can use multiple IPs; does not prevent future attempts from new IPs.
✗
Configure Azure AD Conditional Access to require MFA for the account.
Why it's wrong here
MFA does not prevent password spray; attacker does not need to authenticate, only guess password.
✓
Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.
Why this is correct
Directly stops all authentication attempts; least operational impact until a secure replacement is created.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Immediately change the password of the svc_backup account.
Why it's wrong here
Password change may not take effect immediately due to replication; attacker may continue using cached credentials.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may choose to change the password (Option D) thinking it is the fastest containment action, but they overlook the synchronization delay in hybrid environments and the risk of breaking automated processes, whereas disabling the account is the definitive containment step per incident response best practices.
Detailed technical explanation
How to think about this question
Service accounts like 'svc_backup' often have highly privileged delegated permissions (e.g., 'Back up files and directories' privilege) that allow them to read the NTDS.dit database, making them prime targets for password spraying. In a hybrid environment, Azure AD Connect synchronizes password changes every 30 minutes by default, so a password change may not immediately protect cloud-integrated services. Disabling the account in Active Directory instantly revokes all authentication tokens and prevents any further logon attempts, including those using cached credentials, across both on-premises and cloud domains.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account. — Option C is correct because disabling the compromised service account in Active Directory immediately stops the ongoing password spraying attack, preventing further unauthorized access attempts. This action contains the threat within the 15-minute containment window while minimizing operational impact, as the backup team can switch to an alternate account without disrupting critical backup operations. Disabling the account is faster and more reliable than changing the password, which might not propagate immediately to all domain controllers and cloud services via Azure AD Connect.
What should I do if I get this CISSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security incident, the incident response team identifies that an attacker exfiltrated data via a compromised service account. Which of the following is the BEST immediate step to contain the incident?
medium
A.Notify law enforcement
B.Enable detailed auditing on the account
✓ C.Revoke the service account's privileges
D.Change the password of the service account
Why C: Option C is correct because revoking the compromised account's privileges stops further access. Option A is wrong because changing the password may not be effective if the attacker has established persistence. Option B is wrong while important, auditing alone doesn't stop ongoing exfiltration. Option D is wrong because notifying law enforcement is a later step, not immediate containment.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.