SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS IAM Credentials Report

  Why this is correct

  The AWS IAM Credentials Report is a built-in console or API-generated CSV that inventories every IAM user and the root user, listing each access key's ID, status, creation date, and the exact date and time it was last used. This report is the authoritative source for producing a usage report because it directly provides last-used timestamps without requiring log mining. Generating it is a single action, and it can be refreshed on demand to reflect the most recent activity.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail captures a detailed event history of every API call made in your account, including the caller identity, time, source IP, and the exact API action, but it does not generate a pre-built usage report or a summarized list of all IAM users and their key last-used dates. To reconstruct last-used data from CloudTrail you would need to query event history across all regions and trails, deduplicate, and aggregate by access key — an error-prone process that is neither supported natively nor equivalent to the report. CloudTrail's purpose is auditing and troubleshooting specific actions, not credential lifecycle reporting.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty is a continuous threat-detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail Events using machine learning and threat intelligence to find suspicious behavior such as compromised credentials or unusual API activity. Its output is a set of security findings with severity levels, not a structured inventory of every IAM user's access keys and their last-used timestamps. GuardDuty may flag a rarely used key if it is used in an anomalous way, but it will never provide a comprehensive usage report for all users and keys.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is a configuration management service that records the configuration state of supported AWS resources, like EC2 instances, security groups, and even IAM users, but the recorded configuration items exclude historical access-key last-used timestamps. Config's focus is on detecting configuration drift and evaluating compliance against rules, such as 'access keys should not be older than 90 days,' but it can only evaluate for presence/status, not the 'last used' timestamp. Therefore, Config cannot generate a usage report; it can only help enforce policies based on configuration, not usage.

Go deeper

Related to this question