Using IAM Credential Report to Find and Disable Inactive Users
A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?
Quick Answer
The answer is to use the IAM Credential Report to identify and disable inactive IAM users. This report generates a CSV file containing critical columns like `password_last_used` and `access_key_last_used_date`, which directly show the last time a user authenticated or used their access keys, making it the most accurate native method to find users with no activity for 90 days. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your ability to audit user credentials efficiently without third-party tools, and a common trap is to suggest CloudTrail or Config rules, which are overkill for a simple user-level inactivity check. The key distinction is that the Credential Report is purpose-built for this exact task—it aggregates all user activity in one export. Memory tip: think of the Credential Report as your "inactivity radar" for both passwords and keys, giving you a single CSV snapshot to spot and disable stale accounts.
⚠ Common exam trap
It's easy for candidates to confuse CloudTrail (which logs events) with the IAM Credential Report (which directly reports user activity), or they assume AWS Config can evaluate user inactivity when it is designed for resource configuration compliance, not behavioral monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM Credential Report and disable users with no activity in 90 days
The IAM Credential Report provides a comprehensive CSV export of all IAM users in the account, including the `password_last_used` and `access_key_last_used_date` columns. This allows a security engineer to directly identify users who have had no activity for 90 days and then disable them by applying an IAM policy with a `Deny` effect or removing their credentials. It is the most straightforward, native, and accurate method for this specific task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use CloudTrail to identify users with no recent events
Why it's wrong here
CloudTrail logs events but not aggregated inactivity.
- ✗
Use AWS Config rule to detect inactive users
Why it's wrong here
Config does not track user activity.
- ✓
Use IAM Credential Report and disable users with no activity in 90 days
Why this is correct
Credential Report shows last usage.
- ✗
Use AWS Organizations to disable users
Why it's wrong here
Organizations does not track user activity.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?
hard- A.aws iam get-account-authorization-details
- ✓ B.aws iam generate-credential-report && aws iam get-credential-report
- C.aws iam generate-service-last-accessed-details
- D.aws iam list-access-keys --user-name suspectUser
Why B: The engineer must first generate the credential report using 'aws iam generate-credential-report' and then retrieve it with 'aws iam get-credential-report'. The report contains the age of access keys. Option A is incorrect because 'get-account-authorization-details' retrieves information about account entities, not credential age. Option C is incorrect because 'generate-service-last-accessed-details' is used to find out which services an IAM entity has accessed, not key age. Option D is incorrect because 'list-access-keys' lists keys but does not provide the key age; the credential report includes creation dates.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.