Remediation for Leaked Employee Credentials
Explain concepts related to vulnerability response, handling, and management
An organization was compromised, and the usernames and passwords of all employees were leaked online. Which of the following best describes the remediation that could reduce the impact of this situation?
Answer
Correct answer: B — Force all employees to change their passwords to invalidate the stolen credentials immediately.
Community Insight
The exam tests the distinction between immediate containment (remediation) and future prevention; the common trap is selecting MFA as the primary fix rather than addressing the root cause of the leaked data.
This question addresses the immediate remediation steps required when an organization suffers a credential leak. It establishes that while MFA is a strong long-term control, changing passwords is the definitive action to neutralize compromised secrets.
Candidates often select Multifactor Authentication (A) because it is a 'best practice' security control, failing to realize that MFA cannot prevent access if the attacker already possesses valid credentials before MFA is enabled.
Community Discussion (43 comments)
Berro_b
👍 1
Selected: B
Contain the current credential compromise → Reset passwords. Protect against unauthorized access even when passwords are compromised → MFA.
rvln7
👍 1
Selected: A
Password change = response; MFA = remediation that reduces impact. Leaked passwords alone are no longer enough to authenticate, while a reset only invalidates one set of credentials- the leaked usernames and password patterns stay public. stupid question but i would go with a here
milo34
👍 1
Selected: B
Still going with B as the first step.
Gduru1960
👍 2
Selected: A
A. Multifactor authentication best reduces the impact because even if attackers have valid leaked usernames and passwords, MFA blocks most account takeovers by requiring a second factor, while password changes help but don’t protect accounts that reuse passwords elsewhere, system hardening does not directly stop credential replay, and password encryption is a storage control that does not remediate already-leaked credentials.
bes_i
👍 1
Selected: A
A. Multifactor authentication
G0x47
👍 1
Selected: A
The attacker can change the password first but he has no access to the user email or phone number.
JayWeston
👍 1
Selected: A
Forcing a password change does not do a lot of good if everyone has the old password. You are at the mercy of whoever logs in first. On the other hand if you you can set MFA to a known good source like company email address which the attacker should not have access to.
ybyttv
👍 1
Selected: A
Both A and B could reduce the impact. The question has two key things: remediation + reduce impact Remediation is a long term which fix the root cause. Adding MFA could fix the issue right away.
friendlyneighborhoodITguy
👍 3
Selected: A
Groq, Gemini, ChatGPT, and Copilot - A. The best option to reduce the impact of this situation is A. Multifactor authentication (MFA). While password changes (B) are important and should be done immediately, they don’t fully mitigate the risk if attackers already have access or use credentials elsewhere. System hardening (C) improves overall security posture but doesn’t directly address credential leaks. Password encryption (D) is a preventive measure, but once credentials are leaked, encryption won’t help. Multifactor authentication adds an extra layer of security, making it much harder for attackers to access accounts even if they have stolen usernames and passwords. Organizations should enforce MFA across all critical systems to reduce the risk of unauthorized access.
Only12go
👍 3
Selected: A
Domain 4.2 – “Recommend appropriate response and recovery strategies.” Lists implementing MFA (multifactor / strong authentication) as a primary response to credential-compromise situations. Domain 1.5 – “Explain the importance of awareness training.” Discusses credential reuse, credential-stuffing, and why organizations should adopt MFA to reduce the blast-radius of a leaked password set.
cj207800
👍 1
Selected: A
This is just my opinion. Multifactor authentication (MFA) would immediately mitigate the risk of attackers using stolen credentials, as they would lack the second authentication factor
f90ecff
👍 2
Selected: A
CompTIA emphasizes preventative and layered security controls, especially those that: Mitigate future risk Prevent the reuse of stolen credentials Are aligned with best practices (like zero trust and defense in depth) MFA is often considered a strategic control that makes leaked passwords far less dangerous.
noa808a
👍 2
Selected: B
B is the correct answer. As cartman_sc mentioned, if the password issue is not immediately remediated before setting up MFA, attackers can use the leaked credentials to set up MFA on their own devices, rendering the MFA useless.
DARKVEGETA
👍 3
Selected: B
If you're compromised then the best immediate remediation would be to force all employees to change their passwords immediately to regain control of their accounts and implement multi-factor authentication afterwards for extra security.
SAMIcho
👍 1
Selected: A
While changing password is necessary, attackers may have already accessed accounts before the passwords are changed. Also, users might reuse passwords elsewhere.
luiiizsoares
👍 1
Selected: A
Correct Answer: A. Multifactor authentication Analysis: Multifactor authentication (MFA) is the best remediation to reduce the impact of this situation. MFA adds an additional layer of security by requiring a second form of verification (such as a code sent to a phone) in addition to the password. This ensures that even if passwords are compromised, unauthorized access is still prevented. Explanation of Other Options: B. Password changes: While changing passwords is necessary and should be done immediately, it does not address the fundamental issue of providing an additional layer of security against future compromises. C. System hardening: This involves securing systems by reducing their surface of vulnerability, but it doesn't directly address the immediate threat posed by the leaked credentials. D. Password encryption: Ideally, passwords should already be encrypted. However, once passwords are leaked, encryption cannot reverse the compromise.
Serac
👍 3
Selected: B
I would go with forcing Password Changes, since it would be easier and quicker to implement than MFA if it isn't already in place.
cy_analyst
👍 1
Selected: A
While necessary after a compromise, changing passwords alone does not address the risk of attackers using the credentials before the change. MFA adds an additional layer of protection.
cy_analyst
👍 1
While important, changing passwords alone won’t fully mitigate the risk, as passwords could be leaked again or reused elsewhere. MFA provides ongoing protection even if passwords are compromised.
nap61
👍 3
Selected: B
B. Password changes best describes the immediate remediation that could reduce the impact of this situation. Changing passwords ensures that the leaked credentials are no longer valid, preventing unauthorized access. Multifactor authentication (A) is also a strong security measure but is more of a preventive control rather than an immediate remediation. System hardening and password encryption (D) are important security practices but do not directly address the immediate need to invalidate the compromised credentials.
cartman_sc
👍 19
Selected: B
Implementing MFA immediately after a credential leak doesn't make sense because attackers could use the leaked credentials to set up MFA on their own devices. The most immediate and effective response is to enforce password changes to neutralize the compromised credentials.
JayWeston
👍 1
I disagree, you can force MFA to a device (phone or email) that is already on file but got are at the whim of whoever logs in first if you force a password charge.
ybyttv
👍 2
changing password is the same, attacker already have the password, they just change the password.
KingCyber
👍 4
Selected: A
From Chatgpt: Multifactor authentication (MFA) is the best immediate remediation to reduce the impact of the leaked credentials. It ensures that even if attackers have the correct usernames and passwords, they cannot easily gain access without the second authentication factor. This significantly enhances security and mitigates the risk of unauthorized access. Password changes: While requiring all employees to change their passwords is an important step, it is not sufficient on its own. Attackers could still use other compromised credentials or intercept new passwords. Without additional measures, simply changing passwords does not fully mitigate the risk.
BanesTech
👍 1
Selected: A
Implementing MFA adds an extra layer of security beyond just passwords. Even if usernames and passwords are compromised, an attacker would still need an additional authentication factor (such as a one-time code sent to a mobile device or a biometric scan) to gain access to accounts. MFA significantly reduces the risk of unauthorized access, even with leaked credentials.
8eff281
👍 4
Selected: B
B is the fastest and cheapest method. My experience with CompTIA is that they tend to the treat the cheapest answer be the "best" answer. Not to mention they could implement MFA later but in the immediate they must change the passwords.
jjkylin
👍 1
Selected: A
Multifactor authentication (MFA) is a security method that requires users to provide two or more pieces of evidence to verify their identity, such as a password, a PIN, a fingerprint, or a one-time code. MFA can reduce the impact of a credential leak because even if the attackers have the usernames and passwords of the employees, they would still need another factor to access the organization's systems and resources. Password changes, system hardening, and password encryption are also good security practices, but they do not address the immediate threat of compromised credentials.
bettyboo
👍 6
Selected: B
B. Password changes. You can't put a lock (MFA) after the thief is in your house, it's useless. You need to first fix the problem: thief in your house (password leak), and then you can add the lock (MFA). This question is asking about remediation, what you can do to fix the mess of the passwords being leaked, so: change them all. It's not asking how to make it harder for someone with the leaked passwords to access the service.
Instguy
👍 4
The trick in this question is that they want to see what your immediate response would be as a security analysist, NOT secondary response. "Change passwords" = Immediate response. Add MFA= Secondary response in this case and for this question. Password encryption and hardening maybe implemented late. But, when the damage has been done, they are asking for immediate remediation which, in this case, change passwords. Hope this help.
ha33yp0tt3r69
👍 2
Selected: B
Password Reset: Promptly reset the passwords of all affected user accounts. Ensure that the new passwords meet strong security requirements (length, complexity, uniqueness). Multifactor Authentication (MFA): Implement or enforce MFA for all user accounts. MFA adds an extra layer of protection by requiring additional verification beyond passwords. User Communication: Communicate with all employees about the incident transparently and provide clear instructions on password reset procedures. Emphasize the importance of not reusing passwords across multiple accounts.
Sebatian20
👍 89
Another excellent question from Comptia. How do you sweeten your tea? 1 - Pour hot water and add sugar; or 2 - Add sugar and pour hot water.
ekoetter
👍 1
Selected: B
To remediate, password changes would make most sense.
deeden
👍 1
Selected: A
I vote A because it's asking for improvement. Option B will just have the same level of protection, but of course it's undeniably important that everyone should change their passwords following this event.
LOMCLOTRMC
👍 1
Selected: B
Not all systems support MFA. I think only B can respond immediately.
👍 3
Selected: B
B) password changes Think about it. A user calls in and says they believe their password was compromised. What's the first thing you tell them to do? Change your password. Changing the passwords would invalidate the leaked data. After that, you can implement MFA. Implementing MFA prior to changing the data makes no sense, since the attackers already have 1/2 the information needed to sign in.
chaddman
👍 4
Password Changes (B): This is the most immediate action that can be taken to prevent unauthorized access using the leaked usernames and passwords. Once the passwords are changed, the leaked information becomes outdated and can't be used for unauthorized access.
JBAnalyst
👍 1
The leaked information is not outdate with a password change. The username is still valid. The option said, "change password". A brute force attack could comprise the system. A MFA however, adds another level of protection.
Hedwig74
👍 1
This should have been answered with an "order of steps" answer. According to FRSecure, the steps are: 1. Change passwords 2. Enable MFA. 3. Disable remote login. 4.Revoke tokens. That makes more sense because no one is going to do just one thing about it.
Hedwig74
👍 2
I agree that the prior existence of MFA is best, but as a remediation, wouldn't MFA be more effective than just changing the password, since the vulnerability still exists? The attacker could just steal the new passwords, but they couldn't steal fingerprints, etc...
kmordalv
👍 2
Selected: A
Only the existence of multifactor authentication adds extra protection and ensures that even if the attacker gets a username and password, he cannot access the systems.
kmordalv
👍 4
The question said "the remediation that could reduce the impact of this situation" Password changes, would be a good option if users were aware of the security breach. If attackers already have a password, they could easily figure out the new password. (PEKBAC error) Password encryption is essential for storing passwords securely, but it doesn't prevent unauthorized access when passwords are already compromised. Only the existence of multifactor authentication adds extra protection and ensures that even if the attacker gets a username and password, he cannot access the systems.
ms123451
👍 2
Selected: A
Users can reuse the same password on password change, MFA will make the leak useless since they need another form of authentication
stolleryp
👍 1
But then MFA would be mitigation not remediation. To remediate, password changes would make most sense.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Password changes (B) are the most direct and effective method to reduce the impact of a known credential leak. When usernames and passwords are exposed in plaintext or hashes that can be cracked, the only way to ensure those specific secrets are no longer usable by attackers is to invalidate them immediately. By forcing all employees to change their passwords, the organization renders the stolen database useless.Why the Other Options Are Wrong
Multifactor authentication (A) is a preventative control that adds a second layer of defense, but it does not remove the value of the stolen password itself. If an attacker has already logged in or uses the credentials elsewhere, MFA offers no protection against past compromises. System hardening (C) improves the overall security posture of endpoints or servers but does nothing to address the validity of the leaked user accounts. Password encryption (D) is a storage mechanism to protect passwords at rest; it does not help once the passwords have already been exfiltrated from the system.Community Comment Notes
Many learners initially struggle with this, debating between A and B. As cartman_sc noted, "Implementing MFA immediately after a credential leak doesn't make sense because attackers could use the leaked credentials to set up MFA on their own devices." Bettyboo reinforced this with the analogy: "You can't put a lock (MFA) after the thief is in your house... You need to first fix the problem: thief in your house (password leak)." This highlights the CompTIA preference for immediate remediation of the specific breach over general hardening measures.Exam Strategy
Always distinguish between 'remediation' (fixing the current breach) and 'mitigation/prevention' (stopping future breaches). For credential leaks, the immediate fix is always to invalidate the compromised data (change passwords/revoke tokens), whereas MFA is a secondary control to prevent recurrence.
Frequently Asked Questions
Why isn't MFA the best answer for leaked passwords?
MFA prevents unauthorized access going forward, but it does not negate the fact that the stolen passwords are still valid for existing sessions or other services where MFA isn't used.
Should we encrypt passwords instead of changing them?
Encryption protects passwords at rest. Once they are leaked, encryption is irrelevant to stopping the attacker who already has the data; changing the password removes the risk entirely.