A company must immediately disable compromised IAM users across all AWS accounts and collect all actions performed by the user in the last 7 days. Which solution will meet these requirements?

Question

Options

• ADisable the IAM user and query CloudTrail logs in Amazon S3 using Athena.
• BRemove IAM policies and query logs in Security Hub.
• CRemove permission sets and query logs using CloudWatch Logs Insights.
• DDisable the user in IAM Identity Center and query the organizational event data store.

• A
  19% (5)
• B
  7% (2)
• C
  7% (2)
• D
  67% (18)

Explanation

Explanation

Option D is correct because IAM Identity Center (formerly AWS SSO) manages users centrally across all AWS accounts in an organization, making it the only option that satisfies the "immediately disable across all accounts" requirement with a single action; the organizational event data store in AWS CloudTrail Lake enables powerful querying of activity across the entire organization for the required 7-day timeframe.

Why the distractors are wrong:

• Option A is wrong because disabling an individual IAM user only affects that single account - it doesn't scale across all accounts simultaneously, making it impractical for a multi-account environment.
• Option B is wrong because removing IAM policies doesn't fully disable a user (they could retain other access paths), and Security Hub aggregates findings but isn't designed for querying detailed user action logs.
• Option C is wrong because "permission sets" belong to IAM Identity Center but this option pairs it incorrectly with CloudWatch Logs Insights, which isn't the right tool for querying cross-account IAM activity at the organizational level.

Memory Tip

Think "One pane of glass = IAM Identity Center + CloudTrail Lake." Whenever a question mentions multiple accounts + disabling users + audit trail, IAM Identity Center handles the control (disable once, apply everywhere) while the organizational CloudTrail event data store handles the visibility (query everything in one place).

No community discussion yet for this question.