Investigators confirm that a domain administrator account is being used by an attacker right now to access servers. What is the BEST containment action for this account?
Select an answer to reveal the explanation.
Short Explanation
Changing the lock doesn't help if the burglar's still inside with the door propped open. You change the credentials and kick out every active session. Half-measures, like fixing only the email account, leave the attacker with the keys that matter.
Full Explanation
When a privileged account is confirmed compromised and actively misused, containment must remove the attacker's ability to use it. Disabling the account or resetting its credentials prevents new authentications, and revoking existing sessions and tokens ensures that access already established is terminated, because a password change alone may not end sessions or invalidate issued tokens. Related actions, such as reviewing other privileged accounts and changes the attacker made, follow quickly. Monitoring for another week can be appropriate when an attacker is undetected and a coordinated response is being planned, but here the account is being used now against servers with administrative rights, so the potential damage is immediate and severe. Changing the password on a separate email account addresses a possible initial vector but leaves the compromised domain administrator credentials in the attacker's hands. Reducing logging degrades the organization's own visibility and evidence while doing nothing to stop the attacker. Exam caveat: coordinate with operations before disabling privileged accounts that services depend on, so containment does not cause an avoidable outage, but do not let that coordination become a delay. Operational check: confirm the credential change took effect, all sessions were terminated and authentication logs show no further successful use.