SCS-C02 · Question #185
A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and…
The correct answer is A. Use AWS Identity and Access Management Access Analyzer to determine which resources the B. Deactivate the exposed IAM access key from the user's IAM account. Option B directly addresses the "prevent additional usage" requirement - deactivating the exposed IAM access key immediately revokes it, stopping any further unauthorized API calls, regardless of who holds it. Option A addresses the "identify unauthorized usage" requirement…
Question
A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company's AWS environment A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials. Which combination of steps will meet these requirements? (Choose two.)
Options
- AUse AWS Identity and Access Management Access Analyzer to determine which resources the
- BDeactivate the exposed IAM access key from the user's IAM account.
- CCreate a rule in Amazon GuardDuty to block the access key in the source code from being used.
- DCreate a new IAM access key and secret key for the user whose credentials were exposed.
- EGenerate an IAM credential report. Check the report to determine when the user that owns the
How the community answered
(50 responses)- A82% (41)
- C2% (1)
- D6% (3)
- E10% (5)
Explanation
Option B directly addresses the "prevent additional usage" requirement - deactivating the exposed IAM access key immediately revokes it, stopping any further unauthorized API calls, regardless of who holds it. Option A addresses the "identify unauthorized usage" requirement - IAM Access Analyzer examines resource access policies and activity to reveal which internal resources the compromised credentials may have accessed, giving the security team visibility into potential damage.
C is wrong because GuardDuty is a threat detection service that flags suspicious activity; it cannot create blocking rules or revoke access keys - that's not its function. D is wrong because generating a new key for the user does nothing to deactivate the old exposed key, which remains fully active and exploitable. E is wrong because a credential report only shows surface-level metadata (e.g., last-used timestamps) and cannot identify which resources were accessed by the compromised credentials, making it insufficient for the investigation requirement.
Memory tip: Think "identify + stop" - you need one tool to investigate (Access Analyzer) and one action to kill the key (deactivate, not replace). If an answer creates something new without disabling the old key (D), or detects but can't block (C), it doesn't fully meet the requirement.
Topics
Community Discussion
No community discussion yet for this question.