Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 77 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 77
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company maintains an open-source application that is hosted on a public GitHub repository. While creating a new commit to the repository, an engineer uploaded their AWS access key and secret access key. The engineer reported the mistake to a manager, and the manager immediately disabled the access key.

The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead.

Which solution meets these requirements?

A. Analyze an AWS Identity and Access Management (IAM) use report from AWS Trusted Advisor to see when the access key was last used.
B. Analyze Amazon CloudWatch Logs for activity by searching for the access key.
C. Analyze VPC flow logs for activity by searching for the access key.
D. Analyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used.

Show Suggested Answer

Suggested Answer: D 🗳️

by oioi at Nov. 23, 2023, 8:40 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

46e75dd

4 weeks, 1 day ago

Selected Answer: B

With Credentials Report you will get when last used. However, to gain insights about what were the keys used for you'll have to look at the API calls made using those keys. Hence, you should use cloudtrail.

upvoted 2 times

...

Just_Ninja

9 months ago

Selected Answer: D

If we will get an Hint in the Question like Business or Enterprise Support, then i will choose A. But here is no Hint, so D ist the best Solution.

upvoted 1 times

...

Davidng88

9 months ago

Selected Answer: A

AWS Trusted Advisor provides a comprehensive IAM use report that includes details on when access keys were last used. This report can quickly help you determine if the exposed key was used after it was uploaded to the public repository.

upvoted 1 times

NSA_Poker

8 months, 2 weeks ago

TrustAdvisor can just notify you if your key is exposed and also check for existence of IAM user to discourage root access https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#exposed-access-keys access_key_1_last_used_date is a column in the credential report CSV file. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html#:~:text=access_key_1_last_used_date

upvoted 1 times

...

Sodev

1 year, 2 months ago

"The company needs to assess the impact of the exposed access key" is not right sentence. IAM credential report only show, last active, last active region. It is not show what resource or API is called after exposing keys. => To "Assess the impact" need analyzer Cloudtrail logs.

upvoted 1 times

...

ion_gee

1 year, 2 months ago

Selected Answer: D

D is the best Answer. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html B is not a good answer in this scenario because cloudwatch should be used for monitoring and analyzing log data, and the access key may not be in plaintext due to security reasons. CloudWatch would be more useful for monitoring specific application or system activity rather than tracking the usage of an exposed access key.

upvoted 1 times

...

Raphaello

1 year, 3 months ago

Selected Answer: B

Best answer is B. The ask is to " assess the impact of the exposed access key", which mean how the exposed access key has been used. Credential report does not include such information, it includes information about the credential itself..when it was created, last used, last changed. Not useful to assess the impact.

upvoted 3 times

...

brpjp

1 year, 5 months ago

Selected Answer: B is correct. Question is to analyze impact of exposed access key. From credential report you know only key last used, but not able to determine how many times key used and what activities performed.

upvoted 1 times

...