After identifying a risky Azure Service Principal using the CrowdStrike CIEM/Identity Analyzer, what is the most appropriate action to mitigate the risk?

Question

Options

• AReplace the Service Principal with a managed identity to eliminate credential-related risks.
• BAssign the Service Principal an "Owner" role for temporary troubleshooting purposes.
• CImmediately delete the Service Principal and its associated secrets.
• DRotate the Service Principal's credentials and reduce its permissions to the minimum necessary.

• A
  8% (4)
• B
  13% (7)
• C
  4% (2)
• D
  75% (40)

Explanation

Option A: While managed identities are a secure alternative to Service Principals, this is not always feasible for existing workflows. It may require significant reconfiguration, making it a long- term consideration rather than an immediate action. Option B: Assigning high-level permissions like "Owner" unnecessarily increases risk. Troubleshooting should use roles with only the necessary permissions. Option C: Deleting the Service Principal without understanding its purpose could disrupt workflows or critical services. A more measured approach is necessary to assess and mitigate Option D: Rotating credentials ensures that any compromised secrets are invalidated, while reducing permissions to the minimum necessary aligns with the principle of least privilege. This approach mitigates risks without disrupting the Service Principal's intended functionality.

No community discussion yet for this question.