A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to…

Question

Options

• ADelete the compromised service account.
• BDisable the compromised service account key.
• CWait until the service account credentials expire automatically.
• DRotate the compromised service account key.

• A
  78% (14)
• B
  11% (2)
• C
  6% (1)
• D
  6% (1)

Explanation

Because the attacker already used the key to generate short-lived credentials (e.g., OAuth 2.0 access tokens), simply disabling (B) or rotating (D) the key does not immediately revoke those already-issued tokens - they remain valid until expiry. Deleting the service account entirely causes GCP to immediately invalidate all credentials (including active short-lived tokens) associated with that account, cutting off all unauthorized access at once. Waiting (C) is never acceptable during an active breach. After deletion, you would recreate a new service account with tightly scoped permissions and re-attach it to the affected resources.

No community discussion yet for this question.