How Can the Security Team Trace a Former Employee's Access Key Activity in AWS?
Answer
Correct answer: A — Search the identified access key in the AWS CloudTrail console event history, which retains 90 days of API activity with no trail setup.
The Security team believes that a former employee may have gained unauthorized access to AWS resources sometime in the past 3 months by using an identified access key. What approach would enable the Security team to find out what the former employee may have done within AWS?
Community Insight
The test is whether you know CloudTrail Event History covers exactly 90 days and supports lookup by access key attribute with zero setup — the trap is assuming you must first build an S3 trail and Athena table.
Investigating what an identified access key did over the past three months maps directly to the CloudTrail console's 90-day event history, which is searchable by access key ID without any prior trail configuration. This page confirms why the CloudTrail console (A) is the practical answer over Athena, CloudWatch Logs, or AWS Config.
Choosing Amazon Athena (D) because it is the "real" forensic query tool; Athena only works if a trail is already delivering logs to S3 and tables are defined, which is extra setup the scenario never mentions.
Community Discussion (54 comments)
realdandy
👍 1
Selected: A
You can retrieve the recent 90days API activities in AWS CloudTrail Event History like: User Name, Access Key ID, Event Name, Resource Name, Source IP etc. You can also filter the data by User or Access Key.
bluegardentower
👍 1
Selected: D
Cloud trail and Athena will help investigate activities over a long period (past 3 months) because Athena can run SQL queries directly over CloudTrail logs stored in S3
yash3423
👍 1
Selected: D
When investigating historical activity by an access key over a long period (e.g., 3 months), and especially when looking for specific user actions, the best approach is to: Ensure CloudTrail logs are stored in Amazon S3 Use Amazon Athena to run SQL-like queries on the logs for deep analysis This is: Scalable for large volumes of logs Fast for filtering by access key ID, event source, event name, etc. Cost-effective and fully serverless
thanhpolimi
👍 1
Selected: A
D is correct but what if we haven't created a trail to deliver CloudTrail log to S3 ? So A is acceptable because CloudTrail allows us to search for events for the past 90 days.
VinArc
👍 1
D is correct to fetch logs older than 3 months and easlity apply filter for specific employee
Raphaello
👍 1
Selected: A
A is correct.
Maffo102
👍 1
Selected: A
The interest period is 90 days, then you can simply query logs from AWS Cloudtrail
Benah
👍 1
Use the AWS Cloud Trail console to search for user activity.
Japanese1
👍 1
I think the answer is A. But everyone who says the answer is A is making a false claim. Because even logs from the past 3 months can be queried with S3 + Athena. I wonder if someone can give me a good explanation.
habros
👍 3
Selected: A
Within 3 months: CloudTrail querying Beyond 3 months: CloudTrail + S3, query using Athena
realdandy
👍 1
Selected: D
A is not an answer for this question because this way is to view activities of existing users. For former employee, Cloudtrail logs should be saved in storage like S3 and can be viewed by using query tools like Athena. Therefore the answer is D, I'm sure.
OCHT
👍 1
Selected: D
D. Amazon Athena is a serverless, interactive query service that integrates with S3 and uses standard SQL to analyze data. Athena can be used to query large amounts of CloudTrail data stored in S3, making it an excellent choice for this scenario. Remember the key point that Amazon Athena is used for interactive, ad-hoc querying of data stored in Amazon S3 using standard SQL. It is particularly useful when dealing with large datasets and historical data, such as CloudTrail logs spanning several months.
ITGURU51
👍 2
The Security team can use the AWS CloudTrail console to search for user activity and identify what the former employee may have done within AWS. CloudTrail is a service that records AWS API calls and events for your account and delivers log files to an Amazon S3 bucket that you specify.
Kitman
👍 1
Selected: A
A for sure.
KVK16
👍 3
Selected: A
The key is without any configuration by DEFAULT By Default only CloudTrail is logged A. Paste the Specific Access Key ID in Search bar for Access Key lookup. Other attributes to search in Cloud Trail Events History -Event ID, Source , Resource Name , Resource Type ,Username Athena on Cloudtrail is also good but little time taking - need to create a Athena table and query it A. Best for unusual activity form baseline - Cloud watch insights. B. Config - Resource configuration changes are logged but Access key is not one C. Athena on S3 - Cloudtrail need to be configured to push logs to S3 , after 90days good idea
janvandermerwer
👍 1
Selected: A
A for sure
SonNguy3n
👍 1
Selected: A
The answer is A: You can search the behavior of users in the Event History of the CloudTrails console
tezawynn
👍 1
I think D makes more sense, when you need to query 3 months worth of logs from Cloudtrail
tipzzz
👍 2
https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html
Dot123
👍 2
the answer is A
Kdosec
👍 5
The A answer is correct but the question should be added more details to mention that the quickest or easy approach, because with Athena I also can query for this kind of activity within 90 days.
sanjaym
👍 2
Ans: A 100%
viestner
👍 4
A. Athenea is not the answer, Athenea> 90 dyas
Haxor
👍 3
As it says the logs are less than 3 months old, that means they are available to see in CloudTrail directly, so answer is A!
samar123
👍 3
Perfect Match is A. Reason 1 : UserName is one of the lookable attribute in event history in CloudTrail. This makes search easier. Reason 2 : CloudTrail has to be Enabled explicitly to log in to S3 buckets.
nasreenazad57
👍 1
A is correct
devjava
👍 2
Ans > A
Lunga
👍 1
I think it's D - CloudTrail logs are stored in S3, I don't know which user's access Keyes were used and I would thus have to run some queries. That's where Athena makes sense to run queries against the logs.
AfricanCloudGuru
👍 2
Ans (A), Because it stores the log file for the users
PeppaPig
👍 4
A is correct It's not about the 90 days limit. You can use either console or s3 bucket to query the events in the past 90 days. However in order to use s3 bucket requires that you configure a trail while using console doesn't require any additional setup
HananS
👍 2
You are the same guy comenting three times why
SachinJ
👍 1
I feel D is better solution as every thing form all regions are consolidated into one bucket. For A you got to check all the regions one by one. I understand 90 day limit but S3 would have all days too. Also if there are member accounts etc then it even more difficult. Both the answers are ok but D is better at least for big organizations.
IfyEze
👍 2
ANSWER IS A
tomtom2020
👍 2
Yes, it's "A"
RaySmith
👍 2
A is correct
delirium
👍 2
A is correct
learnaws16
👍 9
Answer is A. 1st question in CloudTrail FAQ, in Getting Started section. "Q: If I am a new AWS customer or existing AWS customer and don’t have CloudTrail setup, do I need to enable or setup anything to view my account activity? A: No, nothing is required to begin viewing your account activity. You can visit the AWS CloudTrail console or AWS CLI and begin viewing up to the past 90 days of account activity."
RakeshTaninki
👍 2
A is correct, cloud trail event histroy or trails.
bp339
👍 2
A is correct
donathon
👍 4
A The user access within the last 3 months which is within the 90 days CloudTrail event history. B: You will not be able to filter by user in CloudWatch. C: AWS Config does not track actions taken by a particular user D: This is still within 90 days. https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-for-activity/
McBTTF
👍 3
A. You can use CloudTrail to search event history for the last 90 days. You can use CloudWatch queries to search API history beyond the last 90 days. You can use Athena to query CloudTrail logs over the last 90 days. https://aws.amazon.com/premiumsupport/knowledge-center/view-iam-history/
AnNguyen
👍 3
Agree. Past 3 month then find on CT, more than 3 months then S3
jaysource
👍 2
A IS THE ANSWER
Danao
👍 1
D is correct
newbie2019
👍 11
Wrong. "sometime in the past 3 months" meaning the logs would be from 0-90 days and then you can find it in CloudTrail logging. If it was older than that, then logs would be stored in S3.
bugybq
👍 1
past 3 months = cloudtrial console
rctaptap
👍 3
A is Correct but If the sentence was older than 90 days the answer is D
exams
👍 2
A makes sense to me
cloudprincipal
👍 2
Agreed
INASR
👍 3
A is correct , cloud trail event history will give you user`s API activities in the last 3 months.
ugreenhost
👍 2
A is correct
josellama2000
👍 33
Use the AWS CloudTrail event history to identify AWS API activity in the last 90 days for your IAM access key. ref- https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-for-activity/
BillyC
👍 3
A or D.. For me A make sense
aws_learner
👍 2
A is within 90 days for sure D is older than 90 days Most cost effective way is "A" so that you don't have run Athena query
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CloudTrail Event History retains 90 days of management events per region and the console exposes searchable attributes including Access Key ID, user name, event name, resource type, and source IP. Three months falls inside that window, so the team can paste the identified access key into the Event History search bar and immediately see every API call made with it — no trail, bucket, or table required. This is exactly what the AWS knowledge-center article on searching CloudTrail for activity by IAM access key describes, and it is the fastest path from "we suspect this key" to a concrete list of actions. The former employee's activity is API activity, and CloudTrail is the authoritative record of AWS API activity, which is why A is decisive.Why the Other Options Are Wrong
CloudWatch Logs (B) only contains CloudTrail data if a trail was explicitly configured to deliver events there, and even then the log stream is not designed for ad-hoc lookups by user or access key without custom metric filters and Insights queries on a JSON payload. AWS Config (C) records resource configuration state and compliance over time; it does not give you a searchable history of "what actions did this principal take", even though it derives the actor from CloudTrail. Amazon Athena (D) is the right tool only after 90 days, when events have aged out of Event History and must be queried from an S3 log archive — and that presupposes a multi-region trail and a defined table, which this scenario does not establish.Community Comment Notes
josellama2000 points to the CloudTrail event history for exactly this 90-day IAM access key lookup and links the AWS knowledge-center article. learnaws16 quotes the CloudTrail FAQ that nothing needs to be enabled: "visit the AWS CloudTrail console or AWS CLI and begin viewing up to the past 90 days". PeppaPig frames the real distinction well — the console needs no additional setup, whereas the S3 route requires a configured trail, and Kdosec concedes Athena could also query recent events but the question asks what simply enables the investigation. habros summarizes the doctrine neatly: three months means CloudTrail querying, beyond that means CloudTrail plus S3 with Athena.Official Reference
Exam Strategy
Anchor on the time window in the stem: anything inside 90 days is CloudTrail Event History, and anything older is an S3 log archive queried with Athena. Also check whether a trail is described — if no trail or S3 bucket is mentioned, tools that depend on stored logs cannot be the answer.
Frequently Asked Questions
Why isn't Amazon Athena the better choice for investigating this access key?
Athena is right only after events age past 90 days into an S3 log archive, and it requires a configured trail plus a table definition — setup the scenario never mentions.
Can AWS Config show which actions a specific user or access key performed?
No. AWS Config tracks resource configuration changes and compliance, not a searchable per-principal history of API calls; CloudTrail Event History is the tool for that.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →