Troubleshooting Compromised Cloud Credentials

Why the Answer Is Correct

The best approach for the administrator to troubleshoot this issue involves resetting the user's account and implementing a stronger lock-out policy. The user's credentials are locked due to suspicious activity, indicating a potential compromise. Resetting the credentials restores access securely, while strengthening the lock-out policy prevents similar unauthorized attempts from locking out legitimate users in the future. This aligns with standard incident response procedures where containment and recovery are prioritized.

Why the Other Options Are Wrong

Option A suggests creating new credentials but restricting access to only the authorized application. While this limits exposure, it doesn't address the root cause of the credential compromise as directly as a reset combined with policy improvement. Option B focuses on tracking login attempts using a WAF, which is useful for investigation but does not immediately resolve the user's access issue. Option D involves installing an IDS, which is a long-term monitoring solution rather than an immediate troubleshooting step for a specific user's locked account.

Community Comment Notes

Community feedback highlights the importance of mitigating the compromised account and enforcing the Principle of Least Privilege. As one commenter noted, "Mitigates the compromised account and enforces the Principle of Least Privilege" supports the decision to reset credentials and adjust policies. Another perspective emphasizes that while tracking attempts is valuable, restoring service securely is the primary goal in this scenario.