Remediation for Leaked Employee Credentials

CS0-003 By islever Editorial Last updated

Explain concepts related to vulnerability response, handling, and management

Short answer

B Force all employees to change their passwords to invalidate the stolen credentials immediately.

Question

An organization was compromised, and the usernames and passwords of all employees were leaked online. Which of the following best describes the remediation that could reduce the impact of this situation?
  1. Multifactor authentication
  2. Password changes Correct Answer
  3. System hardening
  4. Password encryption

Key Takeaways

The exam tests the distinction between immediate containment (remediation) and future prevention; the common trap is selecting MFA as the primary fix rather than addressing the root cause of the leaked data.

This question addresses the immediate remediation steps required when an organization suffers a credential leak. It establishes that while MFA is a strong long-term control, changing passwords is the definitive action to neutralize compromised secrets.

Common mistake: Candidates often select Multifactor Authentication (A) because it is a 'best practice' security control, failing to realize that MFA cannot prevent access if the attacker already possesses valid credentials before MFA is enabled.

Expert Analysis

Why the Answer Is Correct

Password changes (B) are the most direct and effective method to reduce the impact of a known credential leak. When usernames and passwords are exposed in plaintext or hashes that can be cracked, the only way to ensure those specific secrets are no longer usable by attackers is to invalidate them immediately. By forcing all employees to change their passwords, the organization renders the stolen database useless.

Why the Other Options Are Wrong

Multifactor authentication (A) is a preventative control that adds a second layer of defense, but it does not remove the value of the stolen password itself. If an attacker has already logged in or uses the credentials elsewhere, MFA offers no protection against past compromises. System hardening (C) improves the overall security posture of endpoints or servers but does nothing to address the validity of the leaked user accounts. Password encryption (D) is a storage mechanism to protect passwords at rest; it does not help once the passwords have already been exfiltrated from the system.

Community Comment Notes

Many learners initially struggle with this, debating between A and B. As cartman_sc noted, "Implementing MFA immediately after a credential leak doesn't make sense because attackers could use the leaked credentials to set up MFA on their own devices." Bettyboo reinforced this with the analogy: "You can't put a lock (MFA) after the thief is in your house... You need to first fix the problem: thief in your house (password leak)." This highlights the CompTIA preference for immediate remediation of the specific breach over general hardening measures.

Exam Strategy

Always distinguish between 'remediation' (fixing the current breach) and 'mitigation/prevention' (stopping future breaches). For credential leaks, the immediate fix is always to invalidate the compromised data (change passwords/revoke tokens), whereas MFA is a secondary control to prevent recurrence.

Frequently Asked Questions

Why isn't MFA the best answer for leaked passwords?

MFA prevents unauthorized access going forward, but it does not negate the fact that the stolen passwords are still valid for existing sessions or other services where MFA isn't used.

Should we encrypt passwords instead of changing them?

Encryption protects passwords at rest. Once they are leaked, encryption is irrelevant to stopping the attacker who already has the data; changing the password removes the risk entirely.

More CS0-003 FAQ →

Discussion 43 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 43

  1. Sebatian20 👍 89
    Another excellent question from Comptia. How do you sweeten your tea? 1 - Pour hot water and add sugar; or 2 - Add sugar and pour hot water.
  2. cartman_sc 👍 19 Answered B
    Implementing MFA immediately after a credential leak doesn't make sense because attackers could use the leaked credentials to set up MFA on their own devices. The most immediate and effective response is to enforce password changes to neutralize the compromised credentials.
  3. bettyboo 👍 6 Answered B
    B. Password changes. You can't put a lock (MFA) after the thief is in your house, it's useless. You need to first fix the problem: thief in your house (password leak), and then you can add the lock (MFA). This question is asking about remediation, what you can do to fix the mess of the passwords being leaked, so: change them all. It's not asking how to make it harder for someone with the leaked passwords to access the service.
  4. KingCyber 👍 4 Answered A
    From Chatgpt: Multifactor authentication (MFA) is the best immediate remediation to reduce the impact of the leaked credentials. It ensures that even if attackers have the correct usernames and passwords, they cannot easily gain access without the second authentication factor. This significantly enhances security and mitigates the risk of unauthorized access. Password changes: While requiring all employees to change their passwords is an important step, it is not sufficient on its own. Attackers could still use other compromised credentials or intercept new passwords. Without additional measures, simply changing passwords does not fully mitigate the risk.
  5. kmordalv 👍 4
    The question said "the remediation that could reduce the impact of this situation" Password changes, would be a good option if users were aware of the security breach. If attackers already have a password, they could easily figure out the new password. (PEKBAC error) Password encryption is essential for storing passwords securely, but it doesn't prevent unauthorized access when passwords are already compromised. Only the existence of multifactor authentication adds extra protection and ensures that even if the attacker gets a username and password, he cannot access the systems.
Show 25 more comments
  1. Instguy 👍 4
    The trick in this question is that they want to see what your immediate response would be as a security analysist, NOT secondary response. "Change passwords" = Immediate response. Add MFA= Secondary response in this case and for this question. Password encryption and hardening maybe implemented late. But, when the damage has been done, they are asking for immediate remediation which, in this case, change passwords. Hope this help.
  2. chaddman 👍 4
    Password Changes (B): This is the most immediate action that can be taken to prevent unauthorized access using the leaked usernames and passwords. Once the passwords are changed, the leaked information becomes outdated and can't be used for unauthorized access.
  3. 8eff281 👍 4 Answered B
    B is the fastest and cheapest method. My experience with CompTIA is that they tend to the treat the cheapest answer be the "best" answer. Not to mention they could implement MFA later but in the immediate they must change the passwords.
  4. friendlyneighborhoodITguy 👍 3 Answered A
    Groq, Gemini, ChatGPT, and Copilot - A. The best option to reduce the impact of this situation is A. Multifactor authentication (MFA). While password changes (B) are important and should be done immediately, they don’t fully mitigate the risk if attackers already have access or use credentials elsewhere. System hardening (C) improves overall security posture but doesn’t directly address credential leaks. Password encryption (D) is a preventive measure, but once credentials are leaked, encryption won’t help. Multifactor authentication adds an extra layer of security, making it much harder for attackers to access accounts even if they have stolen usernames and passwords. Organizations should enforce MFA across all critical systems to reduce the risk of unauthorized access.
  5. nap61 👍 3 Answered B
    B. Password changes best describes the immediate remediation that could reduce the impact of this situation. Changing passwords ensures that the leaked credentials are no longer valid, preventing unauthorized access. Multifactor authentication (A) is also a strong security measure but is more of a preventive control rather than an immediate remediation. System hardening and password encryption (D) are important security practices but do not directly address the immediate need to invalidate the compromised credentials.
  6. Anonymous learner 👍 3 Answered B
    B) password changes Think about it. A user calls in and says they believe their password was compromised. What's the first thing you tell them to do? Change your password. Changing the passwords would invalidate the leaked data. After that, you can implement MFA. Implementing MFA prior to changing the data makes no sense, since the attackers already have 1/2 the information needed to sign in.
  7. Only12go 👍 3 Answered A
    Domain 4.2 – “Recommend appropriate response and recovery strategies.” Lists implementing MFA (multifactor / strong authentication) as a primary response to credential-compromise situations. Domain 1.5 – “Explain the importance of awareness training.” Discusses credential reuse, credential-stuffing, and why organizations should adopt MFA to reduce the blast-radius of a leaked password set.
  8. DARKVEGETA 👍 3 Answered B
    If you're compromised then the best immediate remediation would be to force all employees to change their passwords immediately to regain control of their accounts and implement multi-factor authentication afterwards for extra security.
  9. Serac 👍 3 Answered B
    I would go with forcing Password Changes, since it would be easier and quicker to implement than MFA if it isn't already in place.
  10. ha33yp0tt3r69 👍 2 Answered B
    Password Reset: Promptly reset the passwords of all affected user accounts. Ensure that the new passwords meet strong security requirements (length, complexity, uniqueness). Multifactor Authentication (MFA): Implement or enforce MFA for all user accounts. MFA adds an extra layer of protection by requiring additional verification beyond passwords. User Communication: Communicate with all employees about the incident transparently and provide clear instructions on password reset procedures. Emphasize the importance of not reusing passwords across multiple accounts.
  11. Gduru1960 👍 2 Answered A
    A. Multifactor authentication best reduces the impact because even if attackers have valid leaked usernames and passwords, MFA blocks most account takeovers by requiring a second factor, while password changes help but don’t protect accounts that reuse passwords elsewhere, system hardening does not directly stop credential replay, and password encryption is a storage control that does not remediate already-leaked credentials.
  12. f90ecff 👍 2 Answered A
    CompTIA emphasizes preventative and layered security controls, especially those that: Mitigate future risk Prevent the reuse of stolen credentials Are aligned with best practices (like zero trust and defense in depth) MFA is often considered a strategic control that makes leaked passwords far less dangerous.
  13. Hedwig74 👍 2
    I agree that the prior existence of MFA is best, but as a remediation, wouldn't MFA be more effective than just changing the password, since the vulnerability still exists? The attacker could just steal the new passwords, but they couldn't steal fingerprints, etc...
  14. noa808a 👍 2 Answered B
    B is the correct answer. As cartman_sc mentioned, if the password issue is not immediately remediated before setting up MFA, attackers can use the leaked credentials to set up MFA on their own devices, rendering the MFA useless.
  15. kmordalv 👍 2 Answered A
    Only the existence of multifactor authentication adds extra protection and ensures that even if the attacker gets a username and password, he cannot access the systems.
  16. ms123451 👍 2 Answered A
    Users can reuse the same password on password change, MFA will make the leak useless since they need another form of authentication
  17. ybyttv 👍 2
    changing password is the same, attacker already have the password, they just change the password.
  18. luiiizsoares 👍 1 Answered A
    Correct Answer: A. Multifactor authentication Analysis: Multifactor authentication (MFA) is the best remediation to reduce the impact of this situation. MFA adds an additional layer of security by requiring a second form of verification (such as a code sent to a phone) in addition to the password. This ensures that even if passwords are compromised, unauthorized access is still prevented. Explanation of Other Options: B. Password changes: While changing passwords is necessary and should be done immediately, it does not address the fundamental issue of providing an additional layer of security against future compromises. C. System hardening: This involves securing systems by reducing their surface of vulnerability, but it doesn't directly address the immediate threat posed by the leaked credentials. D. Password encryption: Ideally, passwords should already be encrypted. However, once passwords are leaked, encryption cannot reverse the compromise.
  19. jjkylin 👍 1 Answered A
    Multifactor authentication (MFA) is a security method that requires users to provide two or more pieces of evidence to verify their identity, such as a password, a PIN, a fingerprint, or a one-time code. MFA can reduce the impact of a credential leak because even if the attackers have the usernames and passwords of the employees, they would still need another factor to access the organization's systems and resources. Password changes, system hardening, and password encryption are also good security practices, but they do not address the immediate threat of compromised credentials.
  20. BanesTech 👍 1 Answered A
    Implementing MFA adds an extra layer of security beyond just passwords. Even if usernames and passwords are compromised, an attacker would still need an additional authentication factor (such as a one-time code sent to a mobile device or a biometric scan) to gain access to accounts. MFA significantly reduces the risk of unauthorized access, even with leaked credentials.
  21. rvln7 👍 1 Answered A
    Password change = response; MFA = remediation that reduces impact. Leaked passwords alone are no longer enough to authenticate, while a reset only invalidates one set of credentials- the leaked usernames and password patterns stay public. stupid question but i would go with a here
  22. JayWeston 👍 1 Answered A
    Forcing a password change does not do a lot of good if everyone has the old password. You are at the mercy of whoever logs in first. On the other hand if you you can set MFA to a known good source like company email address which the attacker should not have access to.
  23. Hedwig74 👍 1
    This should have been answered with an "order of steps" answer. According to FRSecure, the steps are: 1. Change passwords 2. Enable MFA. 3. Disable remote login. 4.Revoke tokens. That makes more sense because no one is going to do just one thing about it.
  24. JBAnalyst 👍 1
    The leaked information is not outdate with a password change. The username is still valid. The option said, "change password". A brute force attack could comprise the system. A MFA however, adds another level of protection.
  25. deeden 👍 1 Answered A
    I vote A because it's asking for improvement. Option B will just have the same level of protection, but of course it's undeniably important that everyone should change their passwords following this event.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide