An IAM administrator at an enterprise health system is conducting emergency offboarding for a compromised account. The administrator disables the user's account in the on-premises Active Directory. However, an hour later, security operations detects ongoing unauthorized administrative API calls performed in the cloud SaaS platform using that identity. Upon reviewing the SCIM bridge synchronization logs, the analyst observes the following log entries:
[2026-07-27 14:02:11] WARN scim_sync_engine: PATCH /Users/usr_88291 HTTP/1.1 429 Too Many Requests - Rate limit exceeded. Account deprecation push failed.
[2026-07-27 14:02:11] INFO scim_sync_engine: Exponential backoff retry scheduled for 14,400 seconds.
[2026-07-27 14:15:00] AUDIT saas_api_gateway: Token authentication successful for usr_88291 via Bearer JWT. Active session valid.
Which of the following operational remediation actions should the analyst take FIRST to immediately terminate the unauthorized active cloud session?
- Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.Cevap
- BManually force an immediate full sync on the SCIM bridge connector to overwrite the rate-limiting backoff timer.
- CReset the compromised user's password in the on-premises Active Directory to force token re-validation.
- DDeploy an emergency block rule on the edge firewall targeting the outbound destination IP addresses of the cloud SaaS platform.