Question 264 of 724
DVA-C02 Security Practice Question
A company wants to enforce multi-factor authentication (MFA) for all users accessing the AWS Management Console. The company has an existing IAM setup with users and groups. Which approach should the developer recommend to enforce MFA?
⚠ Common exam trap
Watch out — candidates often assume MFA can be enforced at the account level (Option A) or by simply adding users to a group (Option D), but AWS requires an explicit IAM policy with a condition key to deny unauthenticated MFA actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to each user that denies all actions unless the user has MFA present.
It uses an IAM policy with a condition key (`aws:MultiFactorAuthPresent`) to deny all actions when MFA is not present. This is the standard AWS-recommended approach to enforce MFA for IAM users accessing the Management Console, as it applies a deny-all-except-MFA effect at the user level without requiring account-level changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MFA at the account level using the AWS Account settings.
Why it's wrong here
AWS Account settings primarily manage billing, contact information, and some global preferences, but they lack a direct switch to enforce MFA across all IAM users. MFA enforcement for IAM users is a granular security control implemented through IAM policies, specifically using conditions that check for MFA presence during authentication. Therefore, this option is incorrect because such a global account-level setting for IAM user MFA enforcement does not exist.
- ✓
Attach an IAM policy to each user that denies all actions unless the user has MFA present.
Why this is correct
This is the correct and recommended method for enforcing MFA. An IAM policy can include a Condition element, such as "aws:MultiFactorAuthPresent": "true", within a Deny statement for all actions ("Action": "*", "Resource": "*") or within an Allow statement that only permits actions if MFA is present. This policy, when attached to users or groups, effectively prevents them from performing any AWS actions unless they authenticate with MFA, thereby enforcing its use across the account.
- ✗
Enable MFA on the root user and require all users to use the root user credentials with MFA.
Why it's wrong here
The AWS root user account possesses unrestricted administrative access to all resources within an AWS account and cannot be restricted by IAM policies. Sharing these highly privileged credentials, even with MFA enabled, is a severe security anti-pattern as it violates the principle of least privilege and makes auditing individual user actions impossible. Each user should have their own IAM identity with specific, scoped permissions, rather than sharing the single, powerful root account.
- ✗
Create a new IAM group for MFA users and add users to that group.
Why it's wrong here
While creating an IAM group is a good practice for managing permissions for multiple users, merely adding users to a group named 'MFA users' does not inherently enforce MFA. A group itself is just a logical container for users and policies; its name has no functional impact on security controls. To enforce MFA, a specific IAM policy containing a Condition that checks for MFA presence must be attached to that group (or directly to users), denying access if MFA is not used.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which THREE actions are required?
easy- ✓ A.Instruct users to use their MFA device when logging in
- B.Configure a password policy that requires MFA
- C.Create a service control policy (SCP) to enforce MFA
- ✓ D.Enable MFA for each IAM user
- ✓ E.Create an IAM policy that denies access unless MFA is present
Why A: To enforce MFA for IAM users, three technical steps are required: 1. Create an IAM policy that denies access to AWS services unless MFA is present (using the `aws:MultiFactorAuthPresent` condition). 2. Attach this IAM policy to the IAM users or groups to enforce the restriction. 3. Enable MFA for each IAM user (either via administrator setup or by allowing users to self-register their MFA devices).
Last reviewed: Jun 11, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.