A cloud security team receives an alert that leaked cloud credentials were detected on a public code repository. The credentials belong to a service account with broad permissions to production cloud resources. What is the correct sequence of immediate response actions?

Question

Accepted Answer

A. Revoke and rotate the compromised credentials immediately; audit cloud API activity logs for unauthorized actions taken with those credentials; reduce service account permissions to least privilege. When cloud credentials are exposed, the immediate priority is revoking them to stop unauthorized use, followed by auditing logs for any actions already taken. Reducing permissions to least privilege prevents similar broad-impact exposure in future. The CompTIA Cloud+ V4 Troubleshooting domain covers security incidents including leaked credentials, and the Security domain covers IAM and vulnerability management.

A cloud security team receives an alert that leaked cloud credentials were detected on a public code repository. The credentials belong to a service account with broad permissions to production cloud resources. What is the correct sequence of immediate response actions?

Related Questions

Discussion