SC-200 Practice Question 3764
Exam: SC-200
Domain: Respond to security incidents
Difficulty: hard
In Microsoft Defender for Identity, an alert indicates "Suspected Golden Ticket attack (encryption key theft)". What is the immediate incident remediation step recommended by Microsoft?
Answer Options
A
Reset the password of the Active Directory KRBTGT account twice
B
Delete all user accounts in the domain
C
Restart the local DNS client service on workstations
D
Upgrade all domain controllers to Windows 98
Correct Answer
A: Reset the password of the Active Directory KRBTGT account twice
Explanation
Reset the password of the Active Directory Kerberos Ticket Granting Service account (KRBTGT) twice to invalidate all forged Golden Tickets across the forest.