CLF-C02 Security and Compliance Practice Question
A company wants to implement multi-factor authentication for all IAM users across their AWS Organization without requiring individual account administrators to configure MFA for each user. Which approach enables organization-wide MFA enforcement?
⚠ Common exam trap
Watch out — candidates often confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume that password policies can enforce MFA at the API level when they only manage device assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP that denies all actions unless MFA is authenticated
Service Control Policies (SCPs) can be applied at the root or organizational unit level to enforce a condition that denies all AWS API actions unless the request includes multi-factor authentication (MFA). This ensures that every IAM user across the entire AWS Organization must authenticate with MFA before performing any action, without requiring individual account administrators to configure MFA per user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MFA on the root account only
Why it's wrong here
Enabling MFA on the root account secures only the root user's own credentials, preventing attackers from using the root password or root access keys. IAM users are distinct principals with their own passwords and access keys, and an MFA-enabled root account has no effect on how those IAM users authenticate or what they can access. Thus, IAM users without MFA would still be able to sign in and exercise whatever permissions their IAM policies grant, so this solution leaves the enforcement requirement unmet.
- ✓
Apply an SCP that denies all actions unless MFA is authenticated
Why this is correct
Applying a service control policy at the organization root OU with a Deny statement using the `aws:MultiFactorAuthPresent` global condition key set to `false` prevents every principal in the member accounts from performing API calls unless they authenticated with MFA. SCPs act as a preventive guardrail: they cannot grant permissions, but they can deny all actions when the condition is satisfied, effectively forcing IAM users and roles to present an MFA token for each session. Because the SCP is inherited by all accounts in the OU, this enforces MFA uniformly without modifying each IAM user's permissions.
- ✗
Configure IAM password policies to require MFA
Why it's wrong here
IAM password policies only enforce rules for choosing a password, such as minimum length, complexity, and password expiration; they do not have a setting that requires a user to present an MFA token at sign-in. MFA is an additional authentication factor validated by AWS at the time of sign-in, and it can be enforced only through IAM permission conditions or SCPs, not through an IAM password policy. Consequently, configuring the password policy will not force MFA and cannot deny access to users who have already signed in without MFA.
- ✗
Enable AWS Config rule to check MFA status
Why it's wrong here
AWS Config managed rule `iam-user-mfa-enabled` evaluates IAM users and marks them NON_COMPLIANT when MFA is not enabled. However, Config is a detective control: it only records and reports compliance status after the fact, and it cannot block or deny API calls issued by a user who is already authenticated without MFA. Therefore, while it highlights the problem, it fails to actually prevent access, so it does not meet an "enforce MFA" requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.