Can the spread of infectious disease through water distribution systems be halted by a disinfectant residual? This question is overdue for an answer. Regulatory agencies and water utilities have long been concerned about accidental intrusions of pathogens into distribution system pipelines (i.e., cross-connections) and are increasingly concerned about deliberate pathogen contamination. Here, a simulation framework is developed and used to assess the vulnerability of a water system to microbiological contamination. The risk of delivering contaminated water to consumers is quantified by a network water quality model that includes disinfectant decay and disinfection kinetics. The framework is applied to two example networks under a worst-case deliberate intrusion scenario. Results show that the risk of consumer exposure is affected by the residual maintenance strategy employed. The common regulation that demands a "detectable" disinfectant residual may not provide effective consumer protection against microbial contamination. A chloramine residual, instead of free chlorine, may significantly weaken this final barrier against pathogen intrusions. Moreover, the addition of a booster station at storage tanks may improve consumer protection without requiring excessive disinfectant.