A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?
Trap 1: The employee intentionally accessed the data from that country
Insider threat is possible but less likely without evidence.
Trap 2: A distributed denial-of-service (DDoS) attack overwhelmed access…
DDoS does not steal credentials.
Trap 3: The cloud storage bucket was misconfigured as public
Misconfiguration would not require stolen credentials.
- A
The employee intentionally accessed the data from that country
Why wrong: Insider threat is possible but less likely without evidence.
- B
A distributed denial-of-service (DDoS) attack overwhelmed access controls
Why wrong: DDoS does not steal credentials.
- C
The cloud storage bucket was misconfigured as public
Why wrong: Misconfiguration would not require stolen credentials.
- D
The employee's credentials were stolen via a phishing attack
Phishing could compromise credentials used from a foreign IP.