SCS-C03 Detection Practice Question
A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM Credential Report.
IAM credential reports are the standard way to audit account security. They provide a comprehensive, comma-separated file that contains information about all users in the account and the status of their credentials, including password, access keys, and MFA status. This is critical for security hygiene and compliance, as it allows administrators to proactively disable or remove stale accounts, reducing the risk of unauthorized access via forgotten credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail.
Why it's wrong here
CloudTrail tracks API activity, but it would be extremely inefficient to manually parse thousands of logs to determine if a specific user has performed an action in the last 90 days. The Credential Report provides this data in a single, aggregated format specifically for this purpose.
- ✓
IAM Credential Report.
Why this is correct
The IAM Credential Report generates a report that lists all users and includes fields like 'password_last_used' and 'access_key_1_last_used'. This is the most direct and efficient way to identify users who haven't performed any actions in a specific time frame for compliance auditing.
- ✗
AWS Config.
Why it's wrong here
AWS Config monitors resource configuration history, but it does not track IAM user login activity or credential usage. It is designed to track changes to IAM policies or other AWS resources, not the usage metrics for individual IAM user credentials over time.
- ✗
AWS Trusted Advisor.
Why it's wrong here
Trusted Advisor provides a check for 'IAM Access Key Rotation' and 'MFA on Root Account', but it does not provide a custom report on the usage status of all IAM users over a specific timeframe like 90 days. It is not the correct tool for this task.
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.