AZ400-Q: Remediating a leaked secret
Q: Secret scanning found a database password that a developer accidentally committed and pushed, and it is already present in git history. What is the correct first remediation?
- A) Delete the file in a new commit and move on
- B) Revoke/rotate the leaked credential, then remove it from all history (e.g., filter-branch / purge history) ✓
- C) Just change the password in a new commit
- D) Ignore it since the repo is internal
Answer: B. Once a secret is committed, it is present in every copy of the history, so simply deleting it in a new commit (A/C) does not protect anyone who already cloned it. The credential must be treated as compromised: revoke and rotate it, then scrub it from history and prevent re-introduction (e.g., pre-commit secret scanning).
Why it helps
Knowing the correct remediation order for leaked secrets (revoke/rotate, not just delete) is a frequent DevSecOps/secret-management question.