A user access key is compromised and actively used by an attacker. What's the FASTEST way to revoke access while preserving the user for investigation?
A.Delete the IAM user
Deletion destroys identity attribution needed for forensics.
B.Attach an explicit deny-all policy to the user and deactivate the access key
Deactivate + deny-all = fastest full revocation. Correct.
C.Remove the user from groups
Group removal leaves directly-attached policies and active sessions.
D.Rotate the key to a new value
Rotation doesn't guarantee existing session invalidation.
Why this answer
Deactivate the compromised key (instant — kills future API calls from it) AND attach deny-all to cover other credentials/attached policies (explicit deny overrides everything). Deletion loses attribution; rotation creates a NEW working key but doesn't kill active sessions as cleanly.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response