A security analyst is investigating incidents in which attackers are able to access sensitive data from a corporate application's database. The attacks occur periodically and usually after the release

When attacks consistently follow new application deployments sourced from a code repository, it indicates credentials may be hardcoded in source code, configuration files, or CI/CD pipeline variables that are accessible to attackers. Rotating account credentials revokes any credentials that were exposed during the development or deployment process. This directly addresses the attack vector without disrupting application functionality, and combined with proper secrets management, prevents future compromises.

Migrating the database on premises does not address the root cause of credential exposure during application deployments and introduces new operational complexity.

Forbidding API calls to retrieve data would break the application's core functionality and does not address the credential exposure vector.

Creating a new database service account is a one-time action that does not prevent future credential leakage if the underlying practice of exposing credentials in code or deployment pipelines continues.