Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security administrator at a financial institution is auditing Privileged Access Management (PAM) logs following an automated night-shift batch job failure. The log analysis reveals that a dedicated service account was locked out because a recently updated global security baseline enforced interactive multi-factor authentication (MFA) and a 30-day password expiration policy across all privileged identities. Which of the following is the MOST appropriate operational remedy to ensure unattended batch processing succeeds without compromising privileged security controls?

  1. Migrate the process to use a Group Managed Service Account (gMSA) with automated password rotation, excluding non-interactive identities from interactive MFA enforcement rules.Answer
  2. B
    Disable password expiration for the service account and assign it to the local Administrators group so that credential checks bypass identity provider authentication gates.
  3. C
    Relocate the database host and application servers to an isolated internal management network segment that relies on perimeter boundary isolation to trust all incoming internal connections.
  4. D
    Implement an automated SIEM correlation rule to detect interactive MFA failures for the account and trigger an operator approval playbook during night-shift processing.

Answer

Migrate the batch process to utilize a Group Managed Service Account (gMSA) with automated password rotation while scoping interactive MFA policies strictly to human interactive logins.
Automated batch processing requires non-interactive identity controls. Group Managed Service Accounts (gMSAs) automate password management within domain environments and allow organizations to exempt service identities from interactive human prompts while maintaining strong credential protection.

Step-by-Step Solution

1
Identify the operational cause of the authentication failure.
Recognize that automated non-interactive service accounts cannot fulfill interactive Multi-Factor Authentication (MFA) challenges.
Policy baselines requiring interactive prompts break automated, unattended scheduled tasks.
2
Evaluate identity lifecycle and IAM operational management options for service accounts.
Determine that Group Managed Service Accounts (gMSAs) or managed workload identities provide centralized, programmatic credential rotation.
gMSAs eliminate static passwords and human management overhead while fulfilling security control requirements.
3
Adjust Identity Provider (IdP) Conditional Access policies.
Enforce interactive MFA specifically on user identities, using non-interactive certificate-based or workload identity controls for service accounts.
Ensures strong authentication controls without breaking unattended system operations.

Key Concept

Privileged Account Lifecycle and Service Account Management
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic