DVA-C02 Null Condition Operator Practice Question
Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls?
⚠ Common exam trap
A common trap is thinking that using the Bool condition with true alone (e.g., "Bool": { "aws:MultiFactorAuthPresent": "true" }) is sufficient to enforce MFA. However, without a Deny effect or a Null check, this only allows MFA-authenticated calls but does not block non-MFA calls, leaving a security gap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }
The `Null` condition operator checks whether the `aws:MultiFactorAuthPresent` key is absent or explicitly set to `false`. When set to `false`, it denies API calls that were made without MFA, effectively enforcing MFA for all API operations. Option E is correct because the `Bool` condition operator with `true` requires that MFA was used, but it must be combined with a `Deny` effect to block unauthenticated requests; used alone in an `Allow` statement, it only permits MFA-authenticated calls without blocking non-MFA ones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }
Why this is correct
This denies access if the MFA key is absent (null), effectively requiring MFA.
- ✗
Condition: { "StringLike": { "iam:MFADeviceType": "Virtual" } }
Why it's wrong here
This checks the type of MFA device, not whether MFA was used.
- ✗
Condition: { "ForAllValues:StringEquals": { "aws:SourceIdentity": "admin" } }
Why it's wrong here
This checks the source identity, not MFA.
- ✗
Condition: { "StringEquals": { "iam:ResourcePath": "/" } }
Why it's wrong here
This condition checks the resource path, not MFA status.
- ✓
Condition: { "Bool": { "aws:MultiFactorAuthPresent": "true" } }
Why this is correct
This condition ensures that MFA was used during the request.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.