A county asks why Active Directory remains a large attack surface even when OS patch levels look solid. What explanation best fits?
Select an answer to reveal the explanation.
Short Explanation
Patches fix bugs; they do not fix 'too many Domain Admins' or a messy trust. AD is a giant identity city — streets, keys, and shortcuts matter as much as whether the doors got a firmware update. Misconfigs and trusts keep the surface large.
Full Explanation
A county asking why Active Directory remains a large attack surface even when OS patch levels look solid should hear that feature richness, identity trusts, and common misconfigurations create risk paths that patching alone does not eliminate. AD risk is not limited to domain controllers missing the latest cumulative update. Patched workstations do not make directory ACLs and trusts irrelevant. Antivirus on member servers does not erase identity-path issues such as excessive rights, weak delegation, or protocol downgrade themes. Exam caveat: patch hygiene is necessary but not sufficient for directory security. Operational check: include identity configuration review alongside patch status in the municipal AD assessment, prioritize misconfiguration classes that enable privilege paths, and track remediation owners beyond the patching team. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.