200-201 Question 307
Single answerYou are a junior SOC analyst investigating suspicious behavior in a cloud-hosted application. During your analysis of the logs, you observe multiple unauthorized API calls attempting privileged actions, such as creating new administrator accounts and deleting critical data. What is the most appropriate immediate action to take in response to these unauthorized API calls?
- A
Revoke the API keys associated with the unauthorized calls.
- B
Deploy additional firewalls to block external access to the application.
- C
Notify the end-users of the application about the security incident.
- D
Take no action until the investigation is complete.
Show answer and explanation
Correct answer: A
Explanation
When investigating unauthorized API calls, the priority is to stop the malicious behavior as quickly as possible. Revoking the API keys immediately disables the attacker's access, effectively mitigating the immediate threat. Other actions, such as notifying users or implementing new security measures, are important but secondary to containing the incident.
- A. Correct.
Revoke the API keys associated with the unauthorized calls to immediately stop further malicious actions and prevent continued abuse of the compromised credentials.
- B. Incorrect.
Deploying additional firewalls might improve future security, but it will not immediately stop the ongoing abuse of the API keys.
- C. Incorrect.
Notifying end-users is important for transparency, but it does not address the immediate threat or mitigate the unauthorized actions.
- D. Incorrect.
Taking no action until the investigation is complete allows the malicious activity to continue unchecked, which could lead to further damage.