Finance notices a sharp rise in compute spend on idle project accounts; investigation finds abandoned instances mining cryptocurrency after a compromised API key. What cloud-typical abuse does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Idle boxes suddenly burning cash on ‘work’ nobody ordered usually means cryptojacking. Compromised keys plus forgotten instances are a municipal classic—the city’s wallet pays while someone else’s miner runs. Kill the zombies, rotate keys, and watch spend anomalies.
Full Explanation
Finance noticing a sharp rise in compute spend on idle project accounts, then finding abandoned instances mining cryptocurrency after a compromised API key, illustrates cryptojacking on zombie or abandoned instances billed to the city. Attackers favor neglected municipal workloads and leaked keys because the jurisdiction pays while mining proceeds accrue elsewhere. Approved batch analytics jobs correctly using reserved capacity discounts would be tagged, owned, and expected in budget forecasts rather than appearing as unexplained idle-account burn. Provider metering errors that only appear during leap-second adjustments are not the investigative finding when mining binaries and stolen keys are present. Legitimate autoscaling of a public website during a declared emergency correlates with traffic and change records, not silent miners on forgotten projects. Exam caveat: FinOps anomaly detection is a security signal in cloud—unexpected spend often surfaces compromise before classic IDS alerts in civic accounts. Operational check: quarantine mining instances, disable and rotate the compromised key, review audit events for RunInstances and role use, reclaim or govern idle projects with tags and budgets, and join finance with security on spend-anomaly alerts for municipal cloud accounts.