A security analyst has received information from a third-party intelligence-sharing resource that indicates employee accounts were breached. Which of the following is the NEXT step the analyst should take to address the issue?
A) Audit access permissions for all employees to ensure least privilege.
B) Force a password reset for the impacted employees and revoke any tokens.
C) Configure SSO to prevent passwords from going outside the local network.
D) Set up privileged access management to ensure auditing is enabled.

Question

Quizplus · Accepted Answer

The immediate action after a breach is to secure the affected accounts by forcing a password reset and revoking any active tokens to prevent further unauthorized access.

A Security Analyst Has Received Information from a Third-Party Intelligence-Sharing