Amazon
SCS-C02 · Question #160
A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production…
The correct answer is B. Filter the AWS CloudTrail event history for the TerminateInstances event and identify the. https://aws.amazon.com/blogs/security/how-to-easily-identify-your-federated-users-by-using-aws-
Submitted by lukas.cz· Mar 6, 2026Threat Detection and Incident Response
Question
A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?
Options
- AReview the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the
- BFilter the AWS CloudTrail event history for the TerminateInstances event and identify the
- CSearch the AWS CloudTrail logs for the TerminateInstances event and note the event time.
- DUse Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3
How the community answered
(45 responses)- A2% (1)
- B78% (35)
- C7% (3)
- D13% (6)
Explanation
https://aws.amazon.com/blogs/security/how-to-easily-identify-your-federated-users-by-using-aws-
Topics
#CloudTrail event history#federated user identification#TerminateInstances#incident investigation
Community Discussion
No community discussion yet for this question.