SCS-C02 Security Logging and Monitoring Practice Question
A security engineer needs to identify which IAM users have been inactive for the past 90 days. Which AWS service should the engineer use?
⚠ Common exam trap
Test-takers frequently confuse AWS CloudTrail (which records API calls) with the IAM Credential Report, assuming CloudTrail can directly identify inactive users, but CloudTrail logs do not aggregate per-user last activity dates and require extensive post-processing to derive inactivity, whereas the Credential Report is the purpose-built, single-source solution for this exact use case.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Credential Report
AWS IAM Credential Report is the correct service because it provides a CSV report that lists all IAM users in an account and includes the `password_last_used` and `access_key_last_used_date` fields. By examining these fields, a security engineer can determine which users have not authenticated or used their access keys for more than 90 days, directly meeting the requirement to identify inactive IAM users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS IAM Credential Report
Why this is correct
The IAM Credential Report is the purpose-built tool for this task because it generates a CSV containing every IAM user in the account along with password and access key metadata, including the last-used dates. By reviewing the 'password_last_used' and 'access_key_last_used' columns, you can immediately identify users who have never signed in or never used their keys. This report can also be refreshed programmatically via AWS CLI or the IAM console, making it the most direct audit mechanism.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a central service for storing and querying log files from applications, AWS services, and custom sources, but it does not natively generate an inventory of IAM users or their credential usage. To determine inactivity you would have to first configure CloudTrail to deliver trail logs to CloudWatch Logs, then write complex query expressions across millions of events to infer which users never appear. Because it has no awareness of IAM user identity separate from the log content, it is neither built for nor efficient at this type of user-level audit.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration and compliance service that records changes to AWS resource settings, such as an IAM user's attached policies or group membership, and evaluates those configurations against managed rules over time. It does not capture login events, password last use, or access key activity, and its managed rules like 'iam-user-unused-credentials-check' actually depend on the IAM Credential Report data under the hood. Thus, AWS Config is not the source of the credential usage information, but rather a front-end that consumes the same data the Credential Report provides.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records every API call and ConsoleLogin event as an audit log, which means it technically contains the activity history needed to find inactive IAM users. However, to use it you must scan the entire event history, group events by user ARN, and determine which users have no events over a given period—a labor-intensive process that requires Athena or CloudWatch Logs Insights queries. The IAM Credential Report already pre-computes this last-usage information, so CloudTrail is only necessary when you need the actual event details for a user that is already identified as inactive.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.