Question

A manufacturing company operates a fleet of Windows-based operator workstations on the plant floor. These workstations run legacy HMI (Human-Machine Interface) software that cannot be modified and must remain reachable by shop-floor engineers who share a single physical login. The security architect must design a solution that enforces a hardened OS configuration baseline on these workstations while ensuring that the built-in local administrator account cannot be leveraged for lateral movement using a shared static password. Which combination of capabilities should the architect specify to meet BOTH requirements?

Accepted Answer

Apply the Microsoft Cloud Security Benchmark via Azure Policy machine configuration for the OS baseline, and deploy Windows LAPS to automatically rotate and back up the local administrator password

Answer

Deploy Microsoft Defender for Endpoint attack surface reduction rules only, and rely on Conditional Access session controls to protect the local admin account

Answer

Enable Defender for IoT OT passive network monitoring for the workstations, and enforce Entra Private Access per-app segmentation for the local administrator account

Answer

Configure just-in-time VM access in Defender for Servers, and use a domain Group Policy Object to set a uniform complex local administrator password across the fleet