hardMultiple ChoiceObjective-mapped
Containment of Compromised Service Account for CISSP
An organization with 500 employees operates a hybrid infrastructure with on-premises Active Directory and cloud-based services (Office 365, Azure). The security team receives an alert from the SIEM showing a high number of failed login attempts for a service account named 'svc_backup' from an external IP address. The account has delegated permissions to back up all domain controllers. The attempts are ongoing and fall below the lockout threshold to avoid detection. The team suspects a targeted password spraying attack. The helpdesk reports no recent password changes for this account. The incident response plan requires containment within 15 minutes. The cloud services are integrated with AD via Azure AD Connect. Which of the following actions BEST contains the attack while minimizing operational impact?
Quick Answer
The correct answer is to disable the svc_backup account in Active Directory and notify the backup team to use an alternate account. This action immediately halts the ongoing password spraying attack by revoking the account’s authentication capability across the hybrid infrastructure, including cloud services integrated via Azure AD Connect, without waiting for password changes to propagate. On the CISSP exam, this scenario tests your understanding of the Incident Response phase of containment, specifically the trade-off between speed and operational impact—disabling a service account is faster and more reliable than resetting credentials, which may fail to synchronize in time. A common trap is choosing to change the password first, but that can leave a window for continued attacks due to replication delays. Remember the memory tip: “Disable first, reset later” to prioritize stopping the threat over credential hygiene.
⚠ Common exam trap
Watch out — candidates often choose to change the password (Option D) thinking it is the fastest containment action, but they overlook the synchronization delay in hybrid environments and the risk of breaking automated processes, whereas disabling the account is the definitive containment step per incident response best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.
Disabling the compromised service account in Active Directory immediately stops the ongoing password spraying attack, preventing further unauthorized access attempts. This action contains the threat within the 15-minute containment window while minimizing operational impact, as the backup team can switch to an alternate account without disrupting critical backup operations. Disabling the account is faster and more reliable than changing the password, which might not propagate immediately to all domain controllers and cloud services via Azure AD Connect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the external IP address at the firewall.
Why it's wrong here
Attacker can use multiple IPs; does not prevent future attempts from new IPs.
- ✗
Configure Azure AD Conditional Access to require MFA for the account.
Why it's wrong here
MFA does not prevent password spray; attacker does not need to authenticate, only guess password.
- ✓
Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.
Why this is correct
Directly stops all authentication attempts; least operational impact until a secure replacement is created.
- ✗
Immediately change the password of the svc_backup account.
Why it's wrong here
Password change may not take effect immediately due to replication; attacker may continue using cached credentials.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security incident, the incident response team identifies that an attacker exfiltrated data via a compromised service account. Which of the following is the BEST immediate step to contain the incident?
medium- A.Notify law enforcement
- B.Enable detailed auditing on the account
- ✓ C.Revoke the service account's privileges
- D.Change the password of the service account
Why C: The best immediate step to contain an incident is to revoke the compromised account's privileges (Option C) because it stops further access. Option A (Notify law enforcement) is not an immediate containment step; it is part of post-incident activities. Option B (Enable detailed auditing) helps with investigation but does not stop ongoing exfiltration. Option D (Change the password) may not be effective if the attacker has established persistence on the account or if other backdoors exist; revoking privileges is more definitive.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.