Investigators confirm that an attacker obtained administrative access to the organization's central directory service, which authenticates all users and services. What is the BEST approach to credential remediation?
Select an answer to reveal the explanation.
Short Explanation
If the burglar got hold of the master key ring, changing one lock isn't enough; you rekey the building. With the directory compromised, any credential could be in the attacker's pocket. Leaving service accounts alone is the classic hole they slip back through.
Full Explanation
An attacker with administrative control of a central directory service can extract credential material for any account it holds, create new accounts and alter permissions. Remediation must therefore assume that every account the directory manages may be exposed, not only those observed in use. Credentials for user, privileged and service accounts should be reset in a planned sequence, along with the directory's own sensitive secrets, and unauthorized accounts and permission changes removed. Without that breadth, the attacker can return with credentials that were never changed. Resetting only accounts known to have been used assumes the investigation saw everything, which is unlikely given the access obtained. Resetting standard user accounts while leaving service accounts unchanged leaves highly privileged, often poorly monitored credentials in the attacker's hands; operational stability concerns should be managed through planning, not by exclusion. Waiting for users to reset at normal expiry leaves exposed credentials valid for weeks or months. Exam caveat: wide credential resets can disrupt operations, so they require coordination with service owners and senior management approval, but the scope is set by exposure, not convenience. Operational check: confirm every account category is covered, reset completion is tracked and authentication logs are monitored afterwards.