SCS-C03 · Question #143
A company uses an organization in AWS Organizations to manage its 250 member accounts. The company also uses AWS IAM Identity Center with a SAML external identity provider (IdP). IAM Identity Center…
The correct answer is D. In the organization's management account, use AWS CloudTrail to search for events that match. AWS CloudTrail is the authoritative source for identity-related activity across an AWS Organization. According to the AWS Certified Security - Specialty Official Study Guide, CloudTrail records all AWS API calls and authentication events, including federated sign-ins that occur…
Question
A company uses an organization in AWS Organizations to manage its 250 member accounts. The company also uses AWS IAM Identity Center with a SAML external identity provider (IdP). IAM Identity Center has been delegated to a member account. The company's security team has access to the delegated account. The security team has been investigating a malicious internal user who might be accessing sensitive accounts. The security team needs to know when the user logged into the organization during the last 7 days. Which solution will quickly identify the access attempts?
Options
- AIn the delegated account, use Amazon CloudWatch Logs to search for events that match the user
- BIn each member account, use the IAM Identity Center console to search for events that match the
- CIn the external IdP, use Amazon EventBridge to search for events that match the user details for
- DIn the organization's management account, use AWS CloudTrail to search for events that match
How the community answered
(41 responses)- A5% (2)
- B10% (4)
- C2% (1)
- D83% (34)
Explanation
AWS CloudTrail is the authoritative source for identity-related activity across an AWS Organization. According to the AWS Certified Security - Specialty Official Study Guide, CloudTrail records all AWS API calls and authentication events, including federated sign-ins that occur through AWS IAM Identity Center with an external SAML identity provider. When IAM Identity Center is used, successful federated login events are logged in CloudTrail as ConsoleLogin and AssumeRoleWithSAML events. These events are recorded in the organization's management account when CloudTrail is configured as an organization trail. This allows security teams to centrally search and correlate authentication activity across all member
Topics
Community Discussion
No community discussion yet for this question.