TiaPracticeA company’s cybersecurity team receives the following alert that a production VM was deleted from the virtual network:
21 September 09:19:08 (GMT-5) Resource with ID: PROD-WEB001 was deleted by User: Logging Service
The console to manage virtual network resources uses directory authentication. Only users in a particular directory group can interactively access the virtual network management console. The logging service account is not part of this group and requires some local administration privileges to aggregate logs from various resources. The cybersecurity team discovers the logging service account was previously given full directory administrator privileges and sees the following entry:
21 September 09:10:55 (GMT-5) User with ID: Logging Service was added to the Group: VNet Console Administrators by actor: Logging Service.
The cybersecurity team removes the compromised service account from the directory group.
Which of the following should the cybersecurity team do next to prevent repeat instances of this issue?
Score: 0/0