How Do You Disable a Compromised IAM Identity Center User and Audit Activity?

SCS-C03 By islever Editorial Last updated

Respond to compromised resources and workloads. Design a log analysis solution.

Short answer

D Disable the user in IAM Identity Center to block all account access, then query the organizational CloudTrail event data store for the prior seven days of activity.

Question

A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
  1. Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
  2. Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
  3. Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
  4. Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days. Correct Answer

Key Takeaways

The tested concept is centralized Identity Center containment plus CloudTrail Lake analysis; the trap is choosing account-scoped IAM user changes or Athena over S3 because the logs happen to be in a bucket.

This SCS-C03 question tests immediate containment of a compromised workforce identity in IAM Identity Center and retrospective analysis of seven days of AWS activity. Disabling the user in IAM Identity Center while querying the organizational CloudTrail event data store satisfies both requirements.

Common mistake: The most common wrong answer is A: disabling an IAM user in the management account feels like a direct disable, but it does not revoke the user's Identity Center access to other accounts, and Athena over S3 is unnecessary when an event data store is already configured.

Expert Analysis

Why the Answer Is Correct

Option D aligns with how IAM Identity Center centralizes workforce access: disabling the user stops sign-in to the AWS access portal and blocks access to every assigned account and application, satisfying the requirement to prevent use in any AWS account. The organizational CloudTrail event data store already captures all events from the organizational trail, and CloudTrail Lake supports SQL queries against it, so the engineer can retrieve the compromised user's actions for the prior seven days without building an Athena table over S3. This combination provides immediate containment and the required cross-account forensic scope in one plan. The wording "IAM user's access in IAM Identity Center" is imprecise, but D is the only option that acts on the centralized identity and uses the purpose-built event data store.

Why the Other Options Are Wrong

A is tempting because Athena can query CloudTrail logs in S3, but disabling an IAM user in the management account only affects that account's IAM user and does not revoke the Identity Center user's access to other accounts. B removes policies instead of disabling access, which is slower, potentially incomplete, and Security Hub is not a CloudTrail log query service. C targets permission sets rather than the user's assignments; permission sets are reusable templates, and CloudWatch Logs Insights queries CloudWatch Logs, not the CloudTrail logs sitting in S3. None of these options combines org-wide Identity Center disablement with direct event data store analysis.

Community Comment Notes

gonzales highlighted the key AWS behavior: disabling a user in IAM Identity Center immediately prevents sign-in to the access portal and access to assigned accounts, and noted that "CloudTrail supports querying event data stores" directly. Stpn2me and J-Babe focused on Athena's role for S3 logs, which explains why A attracts votes, but that query capability does not fix A's account-scoped disable action. As gonzales also pointed out, the event data store is the right collection path for the user's actions across accounts.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When IAM Identity Center appears in an incident-response question, separate workforce identity containment from per-account IAM users; the centralized disable action wins. For retrospective log analysis, prefer the CloudTrail event data store/Lake query over Athena unless the question explicitly requires querying raw S3 objects.

Frequently Asked Questions

Why is disabling a management-account IAM user wrong for Identity Center access?

IAM users are per-account and separate from IAM Identity Center users; disabling the management-account IAM user does not stop the compromised Identity Center user from signing in to other assigned accounts.

Can CloudWatch Logs Insights query CloudTrail logs stored in the S3 bucket?

No. Logs Insights queries CloudWatch Logs log groups, not S3 objects; the organizational event data store is queried through CloudTrail Lake instead.

More SCS-C03 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. gonzales 👍 1 Answered D
    The company uses AWS IAM Identity Center to manage user access, and AWS says disabling a user in IAM Identity Center immediately prevents that user from signing in to the AWS access portal and from accessing assigned AWS accounts and applications. CloudTrail supports querying event data stores and Lake queries directly, which is the right way to collect the user’s actions across accounts for the last 7 days.
  2. Stpn2me 👍 1 Answered D
    Isnt Athena used to query things in S3? I said D but I was leaning toward A..
  3. J-Babe 👍 1 Answered A
    Athena is used for querying logs from S3.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How should a secured S3 CloudFormation template be shared across AWS Organizations?

S-grade

How to enforce MFA for AWS CLI EC2 commands?

S-grade

How to Find S3 Buckets with Sensitive Data Using Macie with Least Overhead?

S-grade

How Can the Security Team Trace a Former Employee's Access Key Activity in AWS?

S-grade

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide