A municipal AD security review finds that privileged group membership and ACL changes are not monitored. What operational gap does that primarily create?
Select an answer to reveal the explanation.
Short Explanation
If nobody is watching who gets added to Domain Admins or who suddenly owns a critical OU ACL, bad changes can sit there quietly. Detection is half the AD defense story — rights without eyes on them are a blind spot.
Full Explanation
Lack of monitoring on privileged group membership and ACL changes weakens detection of dangerous Active Directory modifications. If a city cannot see who joined Domain Admins-equivalent groups or who gained write on critical ACLs, escalation and persistence can proceed without timely response—undermining defenses for systems that serve residents.
Desktop theme approvals are unrelated. Kerberos lifetimes do not automatically collapse when monitoring is absent. Unmonitored privileged groups are not merely a DNS scavenging issue.
Exam caveat: detection engineering for AD is part of operational maturity; technical misconfigurations plus blind monitoring equals delayed incident response. CPTS reporting should recommend monitoring high-risk directory changes as a control, not only list static ACL issues.
Operational check: enable and tune alerts for privileged group and sensitive ACL changes, test that civic SOC/IR receives them, and periodically review false negatives with tabletop AD-compromise scenarios. Feed privileged-group alerts into the municipal SOC runbooks with clear escalation to identity owners when unexpected Tier-0 membership changes appear. Without those alerts, county IR learns of Tier-0 changes only after damage is visible elsewhere.