CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Shield

  Why it's wrong here

  AWS Shield is a managed distributed denial-of-service (DDoS) protection service that defends resources such as CloudFront, Route 53, and Elastic Load Balancers from volumetric and stateful attacks. It operates at the network and transport layers (and for Shield Advanced, the application layer) to filter traffic before it reaches destination resources, but it has no interaction with authentication sessions or IAM. Console MFA is a logical access control set during the sign-in process; Shield cannot validate user identity or enforce a second factor, so it is irrelevant to this security requirement.

• ✓

  Multi-Factor Authentication (MFA)

  Why this is correct

  Multi-Factor Authentication (MFA) is the correct control because it requires a second authentication factor in addition to a password, such as a time-based one-time password (TOTP) from an authenticator app or a hardware security key. With MFA enabled on an IAM user or the AWS account root user, even if a password is compromised, an attacker cannot fully authenticate without the physical second factor. AWS recommends MFA for all users, and the root user can have MFA enforced by an account policy to significantly reduce the risk of credential theft leading to unauthorized console access.

• ✗

  AWS WAF

  Why it's wrong here

  AWS WAF is a managed web application firewall that inspects HTTP/S traffic to resources like Application Load Balancers, CloudFront distributions, and API Gateway APIs. Its core function is blocking common web exploits such as SQL injection and cross-site scripting; it operates at layer 7 (application) and has no visibility into AWS console authentication events. Because MFA enforcement happens within AWS Identity and Access Management (IAM) during the sign-in flow, AWS WAF cannot add or manage an MFA requirement for console users.

• ✗

  Amazon Cognito

  Why it's wrong here

  Amazon Cognito is an identity service designed for end-user sign-up and sign-in in customer-facing applications, using user pools and identity pools to issue tokens for accessing app backends. AWS console authentication, by contrast, is controlled by IAM principals and policies, and administrators enable MFA directly on IAM users, groups, or the root user. While Cognito can support MFA within its own user pools, it does not govern IAM console credentials and therefore cannot serve as the MFA mechanism for AWS account access.

Go deeper

Related to this question