A company requires that all IAM users authenticate using Multi-Factor Authentication (MFA) before they can access any AWS APIs via the CLI. How can the Solutions Architect enforce this requirement globally across the AWS account?

Answer options:

Enable MFA in the AWS Management Console for all users.

Attach an IAM policy to all users that denies all actions unless the aws:MultiFactorAuthPresent condition key is true.

Use AWS Config to delete IAM users who do not have MFA enabled.

Configure AWS IAM Identity Center (AWS SSO) to require MFA.

How to approach this question

Identify the IAM condition key for MFA.

Full Answer

B.Attach an IAM policy to all users that denies all actions unless the aws:MultiFactorAuthPresent condition key is true.✓ Correct

To enforce MFA for API/CLI access for IAM users, you must use an IAM policy with the `aws:MultiFactorAuthPresent` condition key set to `true`. Users must then use `sts:GetSessionToken` with their MFA code to get temporary credentials.

Common mistakes

Assuming enabling MFA in the console automatically protects the CLI.

Question 57 All questions Question 59

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 7

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is designing a multi-region network architecture connecting 50 AWS accounts a...Hard Q02A company is migrating its hybrid network to AWS. They have two 10 Gbps AWS Direct Connect connec...Hard Q03An enterprise has 100 AWS accounts in AWS Organizations. The security team mandates that all Amaz...Medium Q04A financial company requires that all EBS volumes, S3 buckets, and RDS databases be encrypted usi...Easy Q05An enterprise is designing a disaster recovery strategy for a critical application running on Ama...Hard

View all 75 questions →