Google Cloud Professional Cloud Security Engineer Practice Exam

If a service account key has been compromised, what should be the immediate action to secure access?

1. Rotate the API keys

2. Delete the compromised service account

3. Revoke all OAuth tokens

4. Notify all team members of the breach

The correct answer is: Delete the compromised service account

The most effective immediate action to take when a service account key has been compromised is to delete the compromised service account. This step ensures that any unauthorized access through the compromised key is completely stopped, thereby eliminating the risk of further exploitation. Deleting the service account removes its credentials from circulation, effectively severing any existing connections that might be established with systems or services. Additionally, this action helps prevent the malicious actor from retaining any ongoing access that could result in unauthorized data manipulation or exfiltration. While other actions such as rotating API keys, revoking OAuth tokens, or notifying team members may be part of a broader response plan, they do not immediately eliminate the risk associated with the compromised credentials. Rotating API keys can be helpful, but if the service account itself remains intact, there is still a risk of misuse. Revoking OAuth tokens can disrupt access but does not address the underlying issue of the compromised account. Notifying team members is crucial for awareness and response but does not provide direct mitigation of the immediate threat. Thus, deleting the compromised service account is the priority action that directly addresses the security breach.