After a municipal access key leaks, which response set best matches Cloud+ security troubleshooting depth?
Select an answer to reveal the explanation.
Short Explanation
Leaked key playbook: kill the key, see what it did in the audit trail, then tighten who can get new keys. Renaming the user while leaving the same secret active fools nobody.
Full Explanation
After a municipal access key leaks, the response set that best matches Cloud+ security troubleshooting depth is to rotate or revoke the compromised keys, review audit trails for abuse, and tighten IAM least privilege. Containment, investigation, and hardening belong together for civic credential incidents. Only renaming the IAM user and leaving the same access key active fails to revoke the secret that leaked. Posting a status page apology and waiting for the key to age out naturally leaves an active compromise window. Deleting all CloudTrail-equivalent logs to reduce storage cost during the incident destroys evidence and impairs response. Exam caveat: rotation without log review may miss persistence; log review without rotation leaves the door open—do both. Operational check: revoke the key, analyze API history for suspicious calls, remediate any changes made by the key, apply least-privilege replacements, enable secret scanning, and complete a municipal incident report. In municipal cloud operations, record the chosen control and the rejected alternatives in the change or incident ticket so future on-call staff understand which failure modes were avoided for city services. Re-validate after the next maintenance window that the same decision still holds under current provider limits, identity bindings, and application versions used by the civic platform team.