A cloud developer resigned from an organization and gave a two-week notice.

The strongest control to reduce immediate data-loss risk in this scenario is to remove or restrict access to the source code repository for the departing employee. Cloud+ (CV0-004) security objectives emphasize identity and access management (IAM), least privilege, and offboarding procedures as core controls to prevent unauthorized data access. Once an employee has provided notice—especially when suspicious activity is detected—organizations should rapidly adjust permissions by disabling accounts, removing group memberships, revoking tokens/SSH keys, and limiting repository access to only what is operationally required (or eliminating it entirely). This directly stops continued exfiltration from the primary source.

A policy against password sharing (A) is important but does not address an insider with valid access. Blocking an IP (C) is brittle because the user can change networks or use VPNs, and it doesn’t fix the authorization issue. Cutting all internet access (D) is overly disruptive and may not prevent local syncing or alternative paths. Blocking USB transfers (E) doesn’t stop cloud downloads. Therefore, access removal/restriction to the repository is the most effective mitigation.