A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?

What the interviewer wants to hear

• Assume the keys are already used; bots scan GitHub within minutes
• Deactivate and rotate the keys immediately
• Investigate CloudTrail for activity by that key across all regions
• Look for persistence such as new IAM users, keys, roles or Lambda functions
• Clean up the repo history and prevent repeats with secret scanning and short-lived credentials

Model answer

I would assume the keys are already compromised, because automated bots scan public repos within minutes. First, deactivate the access key in IAM and create a new one only if it is still needed, updating the application. If AWS attached a quarantine policy, I keep it until the review is done. Then I investigate CloudTrail for every API call made with that access key ID, across all regions, since attackers often launch crypto-mining instances in unused regions. I look for persistence: new IAM users, access keys, roles, trust policy changes, Lambda functions, or changes to logging. I also check data access in S3 and review GuardDuty findings and billing spikes. Anything the attacker created is removed. Deleting the commit is not enough, so the history must be rewritten and treated as public forever. To prevent repeats: enable GitHub push protection and secret scanning, use pre-commit hooks, and move to short-lived credentials through IAM roles, SSO or OIDC for CI pipelines.

More hard Cybersecurity Analyst questions

• Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
• Design a threat hunt to find lateral movement in a Windows Active Directory environment.
• Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
• How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
• Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
• You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
• HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
• A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
• How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?