Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 77 discussion

D. Analyze the AWS Identity and Access Management (IAM) credential report to determine the last time the access key was used.The AWS IAM credential report provides detailed information about the last usage date and time of access keys for each IAM user, as well as their status (active/inactive). By using this report, you can quickly and efficiently verify whether the exposed access key was used. Reason for low administrative overhead: The IAM credential report can be easily generated via the AWS Management Console or CLI, allowing direct access to the key's usage details without requiring additional setup or complex analysis.

With Credentials Report you will get when last used. However, to gain insights about what were the keys used for you'll have to look at the API calls made using those keys. Hence, you should use cloudtrail.

If we will get an Hint in the Question like Business or Enterprise Support, then i will choose A. But here is no Hint, so D ist the best Solution.

AWS Trusted Advisor provides a comprehensive IAM use report that includes details on when access keys were last used. This report can quickly help you determine if the exposed key was used after it was uploaded to the public repository.

"The company needs to assess the impact of the exposed access key" is not right sentence. IAM credential report only show, last active, last active region. It is not show what resource or API is called after exposing keys. => To "Assess the impact" need analyzer Cloudtrail logs.

D is the best Answer. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html B is not a good answer in this scenario because cloudwatch should be used for monitoring and analyzing log data, and the access key may not be in plaintext due to security reasons. CloudWatch would be more useful for monitoring specific application or system activity rather than tracking the usage of an exposed access key.

Best answer is B. The ask is to " assess the impact of the exposed access key", which mean how the exposed access key has been used. Credential report does not include such information, it includes information about the credential itself..when it was created, last used, last changed. Not useful to assess the impact.

Selected Answer: B is correct. Question is to analyze impact of exposed access key. From credential report you know only key last used, but not able to determine how many times key used and what activities performed.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

Least effort.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

D 99.999999% sure

correct