Question 102

Explanation

Correct Answer:

A is correct. Microsoft Windows includes a feature called managed service accounts (MSAs), which are Active Directory (AD) domain accounts that are used by services and provide automatic password management. MSAs can be used by multiple users and systems without any of them having to know the password. The way MSAs work is that AD creates policy-compliant passwords for these accounts and regularly changes them (every 30 days by default). Systems and users that are authorized to use these accounts need only be authenticated themselves on a domain controller and be included in that MSA’s access control list (ACL). Think of it as an extension to single sign-on (SSO) where you get to be authenticated as yourself, or as any MSA that you are authorized to access. 

Incorrect Answers:

B is incorrect. The Lightweight Directory Access Protocol (LDAP) does not have built-in facilities for automatically changing the passwords on service accounts. 

C is incorrect. Kerberos does not have built-in facilities for automatically changing the passwords on service accounts. 

D is incorrect. OAuth is an open standard for authorization (not authentication) to third parties, and does not have built-in facilities for automatically changing the passwords on service accounts.