A network administrator has noticed unusual activity with a user's login credentials on the network. The user is attempting multiple simultaneous login across the network, some of which are…

Question

Options

• ADelete the user's AD account.
• BDecrease the user's AD privileges.
• CDisable the user's AD account.
• DReset the password on the user's AD account.

• A
  2% (1)
• B
  4% (2)
• C
  85% (45)
• D
  9% (5)

Explanation

Disabling the user's Active Directory account (C) is the correct immediate response because it stops the suspicious activity instantly while preserving the account, its attributes, and its audit history for investigation. This is the least destructive containment action. Deleting the account (A) would destroy forensic evidence and AD object data needed for the investigation. Decreasing privileges (B) would slow the attacker but not stop the active session or prevent re-authentication. Resetting the password (D) might temporarily block the attacker, but if the attacker has an active session token or other means of access, they could continue - and the password reset alone does not prevent re-authentication attempts. Disabling the account fully blocks all authentication paths until the incident is properly investigated.

No community discussion yet for this question.