Has the stolen integration access been stopped?
A service integration makes suspicious exports. Someone has reset the service account’s password and asks whether the incident can close.
The question
Larkspur Systems and all logs are fictional. Under this platform’s stated behavior, a password reset does not revoke OAuth grants, client secrets or existing sessions. The incident owner may revoke the integration and accepts the temporary interruption. Export job IDs identify completed jobs; different jobs have disjoint record IDs.
| Job ID | Records | |
|---|---|---|
| First entry | A | 150 |
| Repeated entry | A | 150 |
| Later entry | B | 100 |
The integration could read 1,000 records. The log repeats job A; it does not describe a second export.
Preserve audit evidence. Revoke the compromised grant and related sessions, then verify denial with the old credential and review other grants. Do not put a real credential in this exercise.
“Choose your next action and explain the evidence behind it.”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: What does the password reset prove?
What would you do here? Open the move you’d make.
Check the actual access mechanism
The strong move. The supplied platform contract keeps these access mechanisms separate.
Close the incident because the password changed.
Tempting, but it misses something. The OAuth grant and sessions can remain usable.
See how a strong candidate says it
“It proves a password change, not revocation of this integration’s access. Preserve the logs and activate the incident owner’s containment plan.”
Why it works: The supplied platform contract keeps these access mechanisms separate.
Step 2: How many records are confirmed?
What would you do here? Open the move you’d make.
Deduplicate the export jobs
The strong move. Count completed jobs and their disjoint record sets once.
Report 400 distinct records by adding all log rows.
Tempting, but it misses something. That counts job A twice.
See how a strong candidate says it
“Jobs A and B confirm 150 + 100 = 250 distinct exported records. The repeated A entry adds no records.”
Why it works: Count completed jobs and their disjoint record sets once.
Step 3: How does the new job change scope?
A separate retained log confirms job C exported 50 different records. It is a completed job, and its record IDs do not overlap A or B.
What would you do here? Open the move you’d make.
Update the confirmed scope
The strong move. Known access is a lower bound when evidence is incomplete.
State that only 300 records could have been exposed.
Tempting, but it misses something. The integration could access 1,000; the logs do not prove that all other records were untouched.
See how a strong candidate says it
“The confirmed exported total is now 300. We still do not know whether the other 700 accessible records were read.”
Why it works: Known access is a lower bound when evidence is incomplete.
Step 4: What closes the containment action?
What would you do here? Open the move you’d make.
Verify denial and continue scope review
The strong move. Stopping this access path and proving total exposure are different tasks.
Treat no new alerts as proof that every access path is closed.
Tempting, but it misses something. Silence in one detector is not a test of revoked credentials or other grants.
See how a strong candidate says it
“Verify that the old grant and sessions are denied, check for other usable grants, and record the incident owner’s result. Keep scope analysis open.”
Why it works: Stopping this access path and proving total exposure are different tasks.
The answer, in short
- Decision
- Revoke and verify the compromised integration access; continue scope analysis.
- Because
- A password reset does not close the stated OAuth path, and the logs confirm at least 300 records.
- What would change it
- Denial tests and a complete grant review can establish containment; more evidence can change scope.
Common traps
- Duplicate log rows are not duplicate data exports.
- No new alert is not proof of containment.
Check your answer
- I separated passwords, grants and sessions.
- I counted each job once.
- I distinguished confirmed from possible scope.
- I named verification of the old access path.
Last reviewed Nov 10, 2026