SC-200 · Question #147
Your company has an on-premises network that uses Microsoft Defender for Identity. The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos…
The correct answer is B. Modify the properties of the computer objects listed as exposed entities. Unsecure Kerberos delegation is an Active Directory misconfiguration where computer objects are enabled for unconstrained or broadly scoped Kerberos delegation, allowing credential impersonation attacks. The remediation is to modify the properties of the exposed computer…
Question
Your company has an on-premises network that uses Microsoft Defender for Identity. The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delegation. You need remediate the security risk. What should you do?
Options
- AInstall the Local Administrator Password Solution (LAPS) extension on the computers listed as
- BModify the properties of the computer objects listed as exposed entities.
- CDisable legacy protocols on the computers listed as exposed entities.
- DEnforce LDAP signing on the computers listed as exposed entities.
How the community answered
(35 responses)- A6% (2)
- B77% (27)
- C14% (5)
- D3% (1)
Explanation
Unsecure Kerberos delegation is an Active Directory misconfiguration where computer objects are enabled for unconstrained or broadly scoped Kerberos delegation, allowing credential impersonation attacks. The remediation is to modify the properties of the exposed computer objects in Active Directory-specifically on the Delegation tab-to remove unconstrained delegation or restrict it to specific services (constrained delegation) or disable it entirely. Installing LAPS addresses local administrator passwords, disabling legacy protocols targets NTLM/LM, and enforcing LDAP signing addresses directory query security-none of these target Kerberos delegation settings.
Topics
Community Discussion
No community discussion yet for this question.