mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: During a security assessment, it is found that…
During a security assessment, it is found that service accounts have interactive logon rights. What is the BEST remediation?
⚠ Common exam trap
Many candidates choose a Group Policy or password-strength solution because they focus on mitigating the symptom (interactive logon) rather than selecting the architectural fix (MSAs) that eliminates the root cause and aligns with the principle of least privilege and secure design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use managed service accounts instead.
Managed Service Accounts (MSAs) are the best remediation because they are designed specifically for service accounts, automatically manage password changes, and by default have no interactive logon rights. This eliminates the security risk of interactive logon while also addressing password management and reducing administrative overhead. Group Policy changes or manual password policies do not address the underlying architectural issue of using a standard user account for a service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Group Policy to deny interactive logon for service accounts.
Why it's wrong here
While implementing Group Policy to deny interactive logon is technically feasible, it represents a reactive control that requires diligent configuration and ongoing management. This approach relies on administrators correctly applying and maintaining GPOs across the environment, which can be prone to misconfiguration or oversight. Microsoft's recommendation for Managed Service Accounts (MSAs) highlights that GPOs are not the most robust or proactive solution for this specific problem, as MSAs inherently lack interactive logon rights by design.
- ✗
Ensure service accounts use strong passwords.
Why it's wrong here
Ensuring service accounts use strong passwords is a fundamental security best practice for all accounts, including those used by services. However, the strength of a password primarily mitigates the risk of brute-force or guessing attacks if an interactive logon attempt is made. It does not, by itself, remove the inherent capability of a standard user account to perform an interactive logon, which is the core vulnerability the question aims to address.
- ✓
Use managed service accounts instead.
Why this is correct
Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs) are purpose-built to enhance the security posture of services by design. They inherently lack the capability for interactive logon, effectively preventing their misuse by attackers attempting to gain a desktop session on a server. Furthermore, MSAs automate complex password generation and periodic rotation, significantly reducing administrative overhead and eliminating the risk of stale or weak passwords.
- ✗
Remove service accounts from the local Administrators group.
Why it's wrong here
Removing service accounts from the local Administrators group is a critical application of the principle of least privilege, preventing services from operating with excessive administrative rights. While this is an essential security measure, it addresses the *privileges* an account possesses *after* a successful logon, not the *ability* to perform an interactive logon itself. A standard user account, even without administrative privileges, can still perform an interactive logon unless explicitly denied by other means.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.