CLF-C02 Security and Compliance Practice Question
A company discovered that an IAM user's access keys were accidentally committed to a public GitHub repository. Which immediate action should they take first?
⚠ Common exam trap
The trap here is that candidates may focus on removing the public exposure (e.g., deleting the repo or moving to private) rather than understanding that the keys themselves must be invalidated, as the damage is already done once they are publicly accessible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately deactivate or delete the exposed IAM access keys
The immediate priority when IAM access keys are exposed is to revoke their validity to prevent unauthorized use. Deactivating or deleting the keys ensures that any malicious actor who obtained them from the public repository can no longer authenticate as the IAM user, stopping potential data breaches or resource abuse. This aligns with the AWS security best practice of rotating credentials upon suspected compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the GitHub repository
Why it's wrong here
Deleting the GitHub repository does not revoke credentials that may have already been captured by automated scanners, CI/CD caches, or forks that exist outside the repo. Since the keys are effectively bearer credentials, any clone or log entry containing them remains usable indefinitely. Deletion also removes the ability to investigate the leak source, and the compromised credentials must still be rotated or deactivated to stop unauthorized API access.
- ✓
Immediately deactivate or delete the exposed IAM access keys
Why this is correct
Deactivating or deleting the exposed IAM access keys is the correct and urgent first step because it immediately invalidates the credential material that an attacker may already be using. Deactivation temporarily disables the keys and can be reversed after investigation, whereas deletion permanently removes them, but both actions stop ongoing unauthorized API calls in near real time. This should be followed by rotation (creating new keys) and auditing CloudTrail for any malicious activity performed with the compromised keys.
- ✗
Enable MFA for the IAM user
Why it's wrong here
Enabling MFA for the IAM user does not protect against misuse of the leaked access keys because access key authentication is a separate path from console sign-in. While MFA adds a second factor for interactive and some STS-based sessions, the access key (Access Key ID + Secret Access Key) is used directly to sign API requests and remains fully valid unless revoked. Thus, MFA is a good security practice but does not address the exposed programmatic credentials.
- ✗
Move the credentials to a private repository
Why it's wrong here
Moving the repository to private is ineffective because the leaked access keys and secret are already publicly exposed in the repository's history or network cache. Any credential-scraping bot that already forked or indexed the public repo retains a copy, and making the repo private does not invalidate or rotate the AWS credentials. The only correct action is to revoke the exposed keys immediately, not to hide them.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.