An attacker obtained the password of a cloud administrator and signed in to the provider's web management console for the company's account. From there the attacker could create, modify or delete any resource. Which statement best describes the risk and the primary control?

The management plane is the set of consoles and APIs used to provision, configure and destroy cloud resources. Because a single privileged identity there can affect every workload, network and data store in the account, it is the highest-value target in a cloud environment, and the CSA guidance treats securing it as a top priority. The primary controls are strong authentication with MFA for all privileged users, least-privilege administrative roles rather than broad owner rights, restrictions on where administrative sessions may originate, short-lived elevation for sensitive actions, and monitoring of management activity. Patching guest operating systems is a customer duty in IaaS, but an attacker with console rights can bypass guests entirely by snapshotting disks or deleting instances. A web application firewall protects application traffic in the data plane from attacks such as injection, which is not the path used here. Physical host security is the provider's responsibility and is unrelated to stolen customer credentials used through a legitimate console. Exam caveat: account and credential compromise is among the most significant cloud threats precisely because of management plane reach. Operational check: confirm every administrative identity is enforced to use MFA and that no standing owner-level access remains for day-to-day work.