A compost-lab service principal still has a password credential created three years ago, and nobody can determine who generated it. What should the security engineer do?
Select an answer to reveal the explanation.
Short Explanation
A three-year-old password that nobody owns is a rusty spare key. Cut it off the principal, hang a certificate—or better, a managed identity—and write up the unrotated secret as a finding.
Full Explanation
Service-principal credential hygiene includes removing unknown or long-lived password credentials and preferring certificates or managed identities for workloads. An unrotated, unowned secret is a security finding even if the principal still functions. Key Vault key rotation policies address vault-managed keys and do not replace cleaning credentials on the service principal itself. Embedding passwords in source control worsens exposure.