CloudTrail shows an IAM user's access key making API calls from an unfamiliar country — the key is compromised. What is the IMMEDIATE first action?
A.Delete the IAM user
Drastic, evidence-destroying — deactivate the key first.
B.Deactivate (or delete) the compromised access key to stop further use
Correct. Stop active misuse immediately, then investigate.
C.Rotate the user's password
Console password ≠ programmatic access key.
D.Open a support case
Support doesn't act faster than your own IAM call.
Why this answer
Kill the credential first — deactivate the access key immediately to stop the bleeding, then investigate (CloudTrail/GuardDuty), rotate remaining credentials, and check for persistence mechanisms the attacker created. Deleting the whole user destroys evidence and may break legitimate workloads; passwords are irrelevant to API-key compromise.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response