An incident responder discovers a secret scanning alert for an exposed cloud access key that the validity check reports as active. They have limited time and must order the remediation steps so that the exposure stops causing harm at the earliest possible moment. Which sequence reflects the correct remediation priority?
Alert: provider cloud access key
Validity: active
Locations: commit a1b2c3 (3 weeks ago) on default branch- AResolve the alert as revoked first to clear it from the queue, then rotate the key, then notify the affected service owners that the credential changed.
- BRotate or revoke the credential at the provider first so the exposed value can no longer authenticate, then resolve the alert as revoked, and rewrite history only if policy requires removing the value. Correct
- CRewrite the git history to purge the commit first, then rotate the key, then resolve the alert once the value no longer appears in any commit on the branch.
- DDisable secret scanning on the repository first to stop further alerts arriving, then rotate the key, then re-enable scanning and resolve the now-closed alert.
Why A is wrong: This puts bookkeeping ahead of remediation; resolving the alert while the key is still active leaves a live exposure and misrepresents the state, since the credential has not yet been invalidated.
Why B is correct: Invalidating the live credential is the action that immediately stops harm because the exposed value becomes useless; resolving the alert records the disposition, and history rewriting is an optional later step that does not reduce live risk.
Why C is wrong: History rewriting is slow and does not neutralise a key that anyone may already have copied; rotating must come first because the leaked value is live until it is invalidated at the provider.
Why D is wrong: Disabling detection blinds the team and does nothing to neutralise the exposed key; the priority is to invalidate the live credential, not to suppress the alerting that surfaced it.