Amazon
SOA-C02 · Question #102
A company requires that all IAM user accounts that have not been used for 90 days or more must have their access keys and passwords immediately disabled. A SysOps administrator must automate the…
The correct answer is D. Set up an AWS Config managed rule to identify IAM users that have not been active for 90 days. https://docs.aws.amazon.com/config/latest/developerguide/iam-user-unused-credentials-
Submitted by tom_us· Mar 30, 2026Security and Compliance
Question
A company requires that all IAM user accounts that have not been used for 90 days or more must have their access keys and passwords immediately disabled. A SysOps administrator must automate the process of disabling unused keys using the MOST operationally efficient method. How should the SysOps administrator implement this solution?
Options
- ACreate an AWS Step Functions workflow to identify IAM users that have not been active for 90
- BConfigure an AWS Config rule to identify IAM users that have not been active for 90 days.
- CDevelop and run a Python script on an Amazon EC2 instance to programmatically identify IAM
- DSet up an AWS Config managed rule to identify IAM users that have not been active for 90 days.
How the community answered
(38 responses)- A8% (3)
- B5% (2)
- C16% (6)
- D71% (27)
Explanation
https://docs.aws.amazon.com/config/latest/developerguide/iam-user-unused-credentials-
Topics
#AWS Config managed rules#IAM credential lifecycle#access key management#automated remediation
Community Discussion
No community discussion yet for this question.