DOP-C02 Security and Compliance Practice Question
A company has a multi-account AWS environment using AWS Organizations. They want to centrally manage user access to all accounts using single sign-on (SSO) and enforce multi-factor authentication (MFA). Which service should they use?
⚠ Common exam trap
Many exam-takers confuse Amazon Cognito (a customer identity service) with workforce identity management, or assume that storing credentials in Secrets Manager or creating per-account IAM users is a viable centralized solution, when in fact AWS IAM Identity Center is the only service designed for multi-account SSO with MFA enforcement in an AWS Organizations context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.
AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user access and permissions across all AWS accounts in an AWS Organization. It natively supports enforcing multi-factor authentication (MFA) through an identity source (e.g., the built-in identity store or an external IdP) and integrates directly with AWS Organizations to grant single sign-on access without needing to create IAM users in each account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Secrets Manager to store and rotate IAM user credentials.
Why it's wrong here
AWS Secrets Manager is designed to store and rotate secrets such as database passwords, API keys, and OAuth tokens, not to manage IAM user identities. It cannot create, modify, or enforce MFA on IAM users, nor does it provide SSO across AWS accounts. Storing IAM user credentials in Secrets Manager would leave static IAM users in each account and still require manual identity lifecycle management, offering no central control.
- ✗
Create IAM users in each account and share the credentials securely.
Why it's wrong here
Creating individual IAM users in every AWS account creates credential sprawl, where each developer needs multiple static passwords and access keys, and every departure requires manual deletion in each account. Securely sharing those credentials across teams is impractical and violates least privilege, and there is no centralized way to enforce a consistent MFA policy or audit cross-account access. This approach does not scale as the organization grows.
- ✗
Use Amazon Cognito user pools with an identity broker.
Why it's wrong here
Amazon Cognito user pools are intended for customer-facing identity and access management, issuing JWTs for app sign-in, not for authenticating workforce users into AWS accounts. Building an identity broker with Cognito would require custom code to map authenticated users to IAM roles, and would not provide native features like permission sets, SCIM provisioning, or centralized MFA enforcement across AWS Organizations. IAM Identity Center is the native AWS service for this purpose.
- ✓
Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.
Why this is correct
AWS IAM Identity Center centralizes workforce identity and builds on AWS Organizations to give users SSO access to all accounts via permission sets, which define granular IAM role permissions. It enforces MFA with policy settings such as requiring MFA for all users or context-dependent MFA, and supports both its built-in directory and external identity providers. Users sign in once at the portal or via the CLI, and IAM Identity Center automatically creates temporary credentials for each account.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.