Cloud access logs show API calls that delete security groups from an identity that should not have that permission. What is the appropriate troubleshooting focus?
Select an answer to reveal the explanation.
Short Explanation
Logs showing deletes from an identity that should be read-only are a break-in alarm, not a CDN problem. Revoke what that identity can use, tighten IAM, and walk the audit trail.
Full Explanation
Evidence of privileged API activity from an identity lacking intended rights requires unauthorized-access incident handling: contain by rotating or disabling credentials, correct IAM, and analyze audit logs for scope. CDN TTLs, database model changes, and disabling NTP are irrelevant or harmful responses.