Exams / CLF-C02 / IAM users, groups and policies / Question 2
CLF-C02 practice question: IAM users, groups and policies (2 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An auditor asks for a list of every IAM user in an AWS account, showing whether each user has MFA enabled and when each user's access keys were last rotated. What is the quickest way to provide this?
Choose one answer.
- AA. Search the AWS CloudTrail event history for each user
- BB. Run IAM Access Analyzer on the account
- CC. Download a report from AWS Artifact
- DD. Generate and download the IAM credential report
Show the answer and explanation
Answer: D
- A. Wrong: Event history shows API calls from the last 90 days. It does not give a summary of every user's credential status.
- B. Wrong: IAM Access Analyzer finds resources shared outside the account and helps refine policies. It does not list MFA status and key rotation dates.
- C. Wrong: AWS Artifact provides AWS's own compliance reports, not information about the customer's IAM users.
- D. Right: Correct. The credential report is a CSV file listing every IAM user and the status of their passwords, MFA devices and access keys.
Explanation
The IAM credential report lists all IAM users in the account with columns such as password_enabled, mfa_active and access_key_1_last_rotated. It is useful for audits and for finding unused credentials, which supports the IAM best practice of regularly reviewing and removing what is not needed.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.