Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

A cloud incident handler detects active unauthorized API activity within a production cloud tenant. Investigation reveals that a developer accidentally committed an administrative API key to a public code repository, allowing an external threat actor to deploy unauthorized compute instances and initiate unauthorized data export jobs. The handler has verified the malicious activity in the cloud provider's audit logs. According to standard incident response lifecycle guidelines, which of the following actions should the handler take FIRST to contain the threat?

  1. Revoke the compromised API key and invalidate all active session tokens generated by that key.Answer
  2. B
    Restore affected database assets from the latest verified clean backup taken before the breach.
  3. C
    Conduct a post-incident review to mandate static code analysis scanning in the developer CI/CD pipeline.
  4. D
    Deploy Web Application Firewall rules to block the threat actor's external IP address.

Answer

Revoke the compromised API key and invalidate all active session tokens generated by that key.
According to NIST SP 800-61 and standard incident response playbooks, when an active security breach involves stolen or leaked credentials, the immediate priority during the Containment phase is to disable or revoke those credentials and invalidate active session tokens. This immediately halts the threat actor's ability to issue management commands without altering system state needed for forensics or jumping ahead to recovery.

Step-by-Step Solution

1
Identify the current incident response phase required by the scenario.
The scenario describes an active breach in progress, indicating an urgent requirement for the Containment phase of the incident response lifecycle.
Containment limits the scope and impact of an incident by preventing further unauthorized actions while preserving evidence for forensic analysis.
2
Evaluate the primary attack vector powering the ongoing intrusion.
The attacker relies on a valid, publicly exposed administrative API key for authentication.
Without valid credentials, the attacker cannot invoke cloud provider management APIs or perform unauthorized operations.
3
Select the immediate containment action that stops credential misuse.
Revoking the compromised API key and terminating associated active sessions immediately stops the attack vector.
Credential revocation neutralizes active session privileges without modifying evidence or prematurely jumping to recovery and post-incident steps.

Key Concept

Incident Response Lifecycle - Containment Phase
Estimated Time:2m 0s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic