CCSP Cloud Security Operations Practice Question
A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?
⚠ Common exam trap
ISC2 CCSP exams often test the distinction between 'disable' and 'rotate' in key compromise scenarios, where candidates mistakenly choose rotation thinking it invalidates the old key, but rotation only creates a new key without disabling the old one unless explicitly done.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the service account key
The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable the service account key
Why this is correct
Disabling the compromised service account key immediately invalidates the credential, halting any further authenticated API calls from the unexpected location. This directly satisfies the containment requirement, since the key itself is the abused authentication artefact and revocation stops the threat without deleting the account's audit history.
- ✗
Create a new service account
Why it's wrong here
Creating a new service account does nothing to the compromised key, which stays active and usable from the unexpected location. Provisioning fresh identities is appropriate when building replacement workloads or separating duties, not when an existing credential is actively being abused and must be revoked.
- ✗
Delete the service account
Why it's wrong here
Deleting the service account removes the identity outright, but the compromised key remains valid until expiry and any attacker-created credentials or persistence survive; it also breaks legitimate workloads. Deletion suits decommissioning an unused account, not containing an active key compromise where the key itself must be revoked.
- ✗
Rotate the key and monitor
Why it's wrong here
Rotating the key leaves the compromised credential valid during the rotation window, so the attacker retains access while monitoring merely observes continued abuse. Rotation is the right ongoing hygiene step after containment, not the immediate action that severs the attacker's current access.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.