An API token has been pasted into a widely visible internal dashboard. What is the correct response?
Select an answer to reveal the explanation.
Short Explanation
Once it's visible, it's compromised. You can't un-see a credential, so revoke it, replace it, and store the new one as a secret.
Full Explanation
The correct response is to treat the token as compromised: revoke it, issue a replacement scoped to the automation, and store the new one as a secret. A credential that has been visible to an uncontrolled audience must be assumed copied. Revoking it invalidates every copy, and the replacement should be handled properly from the start. Restricting who may edit the dashboard is incorrect because edit restrictions do not affect who has already read it. Leaving the token in place and monitoring for unusual API activity is incorrect because detection is not containment; the token remains usable while you watch for misuse. Reducing the token's permissions and continuing to use the same value is incorrect because the exposed value remains valid and still grants whatever permissions remain. For the exam, respond to an exposed credential by revoking and replacing it rather than by adjusting it.