CV0-004 · Question #329
A company's cybersecurity team receives the following alert that a production VM was deleted from the virtual network: 21 September 09:19:08 (GMT-5) Resource with ID: PROD-WEB001 was deleted by…
The correct answer is D. Create a scoped administrative role for the logging service account. The issue occurred because the logging service account had excessive privileges, allowing it to escalate and add itself to the admin group. Assigning a scoped administrative role enforces least privilege, limiting the account to only the permissions required for log…
Question
A company’s cybersecurity team receives the following alert that a production VM was deleted from the virtual network:
21 September 09:19:08 (GMT-5) Resource with ID: PROD-WEB001 was deleted by User: Logging Service The console to manage virtual network resources uses directory authentication. Only users in a particular directory group can interactively access the virtual network management console. The logging service account is not part of this group and requires some local administration privileges to aggregate logs from various resources. The cybersecurity team discovers that the logging service account was previously given full directory administration privileges and they see the following entry:
21 September 09:10:55 (GMT-5) User with ID: Logging Service was added to the Group: VNet Console Administrators by actor: Logging Service. The cybersecurity team removes the compromised service account from the directory group. Which of the following should the cybersecurity team do next to prevent repeat instances of this issue?
Options
- AEnable two-factor authentication on the virtual network console.
- BReset the logging service account to use a long and complex password.
- CDisable RDP on the production virtual machines.
- DCreate a scoped administrative role for the logging service account.
How the community answered
(52 responses)- A29% (15)
- B15% (8)
- C6% (3)
- D50% (26)
Explanation
The issue occurred because the logging service account had excessive privileges, allowing it to escalate and add itself to the admin group. Assigning a scoped administrative role enforces least privilege, limiting the account to only the permissions required for log aggregation, and prevents future privilege escalation.
Topics
Community Discussion
No community discussion yet for this question.