Identity Resilience
Identity Resilience covers the systems that authenticate and authorize users: Active Directory, Entra ID, LDAP, privileged access, and federation. The exam tests whether you treat identity as Tier 0 and can recover it without reintroducing attacker access.
Core rules
- Identity is Tier 0. A compromised directory or federation trust can re-own every restored workload. Keep backup infrastructure off domain credentials; use separate break-glass accounts and MFA.
- Back up directory state, including system state, registry, SYSVOL, and cloud directory configuration. Protect trust keys, service credentials, and federation signing certificates.
- Plan forest recovery: restore in an isolated network, seize FSMO roles if needed, reset krbtgt twice, validate DNS and DHCP, then reconnect members.
- For cloud identity, protect conditional access, app registrations, and privileged roles; retain immutable audit logs.
Worked example
Ransomware encrypts domain controllers. Do not restore a DC onto the production network. Build an isolated recovery network, restore the first DC from a known-clean backup, seize roles, and reset krbtgt twice with replication. Restore additional DCs and validate authentication, DNS, and Group Policy. Only then reconnect member servers. If Entra Connect is compromised, rotate its credentials and review sync rules before re-enabling synchronization.
Traps that cost marks
Using domain admin credentials to manage backups. Restoring a DC directly into production. Resetting krbtgt only once. Forgetting federation signing certificates. Having no break-glass process.