During a quarterly security review, you learn that the backup application’s service identity used to connect to a Data Domain system is subject to password expiry. What should you do to prevent an expired credential from interrupting the next backup window?
Select an answer to reveal the explanation.
Short Explanation
Think of this like changing the key to a locked room while someone’s carrying a copy: update the lock and the key together. If you rotate the Data Domain service password but forget the backup application, you’ll fail the job mid-window. You need a runbook that changes both ends in the same controlled step.
Full Explanation
Data Domain systems can be accessed by backup applications through service identities, and those identities are subject to authentication controls. Because the appliance and application store matching credentials, rotation is a two-sided change: the account password must be changed on the Data Domain system and the new secret must be supplied to the backup application before the next connection. A documented runbook makes the change scheduled, tested, and reversible, preventing an expiry event from appearing as a backup failure. Changing only the appliance side leaves the application using a stale credential. Changing only the application side can lock the account or break authentication after the appliance-side password changes. Removing expiry for an application-facing account weakens the security control the policy was intended to enforce. Replacing the service identity with a shared administrative account increases blast radius and obscures audit attribution. Exam caveat: the exam may use terms such as DD Boost client authentication, CIFS/NFS credentials, or service account, but the principle is coordinated credential rotation for application-facing identities. Operational check: before a backup window, verify that the Data Domain service account password and the backup application’s stored credential were changed in the same change record, then run a small authenticated backup or connectivity test.