Exam SY0-601 topic 1 question 615 discussion

To mitigate the concern of hackers gaining access to the service account and pivoting throughout the global network, the BEST solution would be to create different accounts for each region, limit their logon times, and alert on risky logins (C). Enforcing Kerberos authentication (Option B) is also a good security measure, but it should be used in conjunction with creating different accounts for each region. Kerberos authentication is used to authenticate users over insecure networks and can help prevent attackers from intercepting login credentials. Implementing multi-factor authentication (MFA) (Option A) is also a good security measure, but it should be used in addition to creating different accounts for each region. MFA adds an extra layer of security by requiring users to provide additional authentication factors, such as a code sent to their phone, in addition to their password.

i vote for C, so this is what my company is doing. every of each root login is giving MFA for confirmation. even if hacker gain access to some degree, he can't receive MFA, so he can't login. the problem with C, even if you limit time/ notify risky login, it can't fully prevent hacker login as A. Come on, it is mobile MFA erea. even my school email login is using MFA...

Gotta go with C. Can't be A because service accounts can't acknowledge push notifications.

Configuring push Multi-Factor Authentication (MFA) notifications adds an additional layer of security. Even if attackers manage to compromise one of the accounts, they would still need to bypass MFA to gain unauthorized access, making it significantly more difficult for them to pivot through the network

C - it's a service account, can't MFA

ChatGPT --- Answer: A. Create different accounts for each region, each configured with push MFA notifications. Explanation: Create Different Accounts for Each Region: By creating different accounts for each region, the organization can limit the scope of potential compromise if one account is breached. This approach compartmentalizes access and reduces the impact of a single account compromise. Configured with Push MFA Notifications: Multi-Factor Authentication (MFA) adds an extra layer of security by requiring users to provide additional authentication factors beyond passwords. Configuring accounts with push MFA notifications enhances security by requiring users to approve login attempts via a secondary device or application, adding an additional barrier against unauthorized access.

Because how could a service account respond to a push notification?

The amount of people that have said "A" for a service account is concerning. Had to vote "C" to change the vote a little.

C. Create different accounts for each region, limit their logon times, and alert on risky logins.

This is a credentialed scan. Good luck acknowledging 10,000 MFA push updates to one person each time the scanner logs in to an endpoint. Not a real world solution,

Option A = 2 measures Option C = 3 measures I vote C.

MFA with push notifications will drastically reduce the likelihood of hacker gaining access, more than time based access and alerting, I will go with A here.

Going for A here, with MFA enabled it is unlikely for an attacker to get access to the account even if he/she knows the password. The option C also works however, it does not prevent the attacker from getting access to the account. It just limits the time he could actually log into the account.

Create different accounts for each region, each configured with push MFA notifications. Creating different accounts for each region and limiting logon times can help with segmentation but doesn't add the level of security provided by MFA.

A. Create different accounts for each region, each configured with push MFA notifications. Creating different accounts for each region and configuring them with Multi-Factor Authentication (MFA) push notifications would be a strong approach to mitigate the concern of unauthorized access. With MFA, even if an attacker gains access to the password, they would still need to bypass an additional layer of authentication. By using different accounts for each region, the potential impact of an account compromise is also limited to that region, reducing the risk of an attacker pivoting throughout the global network.

Given the options and the need to prevent attackers from pivoting through the network, Option A (creating different accounts for each region, each configured with push MFA notifications) would be the BEST to help mitigate the concern. C. Limiting logon times can help by restricting the window of opportunity for misuse. However, if attackers are aware of these times, they could potentially work within them

C. Create different accounts for each region, limit their logon times, and alert on risky logins.