A security architect must remove a long-standing risk where every Windows server and workstation in a hybrid estate shares an identical, rarely rotated built-in local administrator password, giving an attacker who cracks one device lateral movement to all of them. The design must automatically randomise and rotate each device's local administrator password and store it so that only authorised staff can retrieve it. Which capability should the architect specify to meet this requirement?
- AWindows Local Administrator Password Solution, configured to automatically randomise and rotate each device's built-in local administrator password and store it in the directory so that only authorised staff can retrieve the current value. Correct
- BMicrosoft Entra Privileged Identity Management, configured to grant just-in-time, time-bound activation of the local administrator role on each Windows device so that standing local administrator credentials are eliminated across the estate.
- CMicrosoft Entra Conditional Access, configured with device-compliance policies so that the shared local administrator account cannot sign in from a device that fails its posture checks across the estate.
- DMicrosoft Defender for Endpoint, configured with attack surface reduction rules so that misuse of the shared local administrator account is blocked and rotated automatically across every onboarded Windows device.
Why A is correct: Windows LAPS is purpose-built to set a unique, automatically rotated local administrator password per device and back it up to Microsoft Entra ID or Active Directory with controlled retrieval, which directly removes the shared-password lateral movement risk.
Why B is wrong: Privileged Identity Management is tempting because it governs privileged role activation, but it brokers just-in-time access to directory and Azure roles rather than randomising and rotating the per-device built-in local administrator password that this requirement targets.
Why C is wrong: Conditional Access is appealing because it gates sign-in by device posture, but it evaluates access to cloud and federated resources rather than randomising or rotating the local administrator password stored on each Windows device itself.
Why D is wrong: Defender for Endpoint is tempting as the device protection plane, but it detects and reduces attack surface rather than managing or rotating local account passwords, so it does not satisfy the credential-rotation requirement.