Which two requirements need to be removed from the domain account properties used for the MSSQL service on the database servers? (Choose two.)

Question

Options

• AA smart card is required for interactive logon.
• BDo not require Kerberos pre-authentication.
• CUse DES encryption types for this account.
• DPassword is not expired.
• EThe account is sensitive and cannot be delegated.

• A
  79% (38)
• B
  13% (6)
• C
  6% (3)
• E
  2% (1)

Explanation

Removing "smart card is required for interactive logon" (A) is necessary because SQL Server runs as a background Windows service using stored credentials - it cannot perform interactive logons or physically present a smart card, so this setting prevents the service from starting. Removing "password is not expired" (D) (effectively meaning: ensure "password never expires" is enabled) is critical because if the service account's password expires, SQL Server will fail to authenticate and stop running. Options B ("Do not require Kerberos pre-authentication") and C ("Use DES encryption types") should actually also be absent or avoided for security reasons, but neither directly blocks the service from starting - making them distractors that test whether you know what breaks the service vs. what is merely a security concern. Option E ("account is sensitive and cannot be delegated") is a valid security hardening measure for many service accounts and should often remain in place, not removed.

Memory tip: Think of the MSSQL service as a robot employee - it logs in automatically in the dark, never touches a smart card (remove A), and must never have its password suddenly expire mid-shift (remove D).

No community discussion yet for this question.