CompTIA SecurityX (CAS-005)Security EngineeringHard
A security engineer is hardening a Windows Server that hosts a critical enterprise application. The application runs as a service and requires access to network resources and specific file shares. To minimize the attack surface and adhere to the principle of least privilege, the engineer wants to assign a service account that automatically manages its password, can be associated with a Service Principal Name (SPN), and supports delegation across multiple hosts. Which type of account should the engineer configure?
- AGroup Managed Service Account (gMSA)
- BManaged Service Account (MSA)
- CLocal System Account
- DLocal Service Account
Show answer & explanationAnswer & explanation
Correct answer: A. Group Managed Service Account (gMSA)
Group Managed Service Accounts (gMSAs) are designed for services running on multiple servers (e.g., a clustered application or load-balanced web farm). They provide automatic password management, SPN management, and can be used on multiple hosts, making them ideal for distributed applications and adhering to least privilege.
Why the other options are wrong
- B. Managed Service Accounts (MSAs) provide automatic password management and SPN registration but are intended for a single host, not for services running on multiple hosts with delegation.
- C. Local System Account has extensive privileges on the local machine and no network authentication capabilities, violating least privilege.
- D. Local Service Account has limited privileges on the local machine and presents anonymous credentials on the network, not suitable for specific resource access or delegation across hosts.
Group Managed Service Account (gMSA)
A type of Active Directory service account that provides automatic password management, simplified Service Principal Name (SPN) management, and the ability to be used by multiple servers simultaneously.
- Automatic password management
- Simplified SPN management
- Can be used by multiple hosts
- Supports delegation
- Enhances security and operational efficiency
Memory trick: gMSA: Group power for multi-host services.