DOP-C02 Security and Compliance Practice Question
A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?
⚠ Common exam trap
DOP-C02 often tests the pairing requirement — candidates pick the condition-key policy but forget it must be attached to users/groups, or they pick SCPs thinking account-level controls enforce user MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the policy to all IAM users or a group containing all users
Option C is correct because an IAM policy that uses the aws:MultiFactorAuthPresent condition key with a Deny effect when the value is false is the standard mechanism to block console (and API) actions for users who have not authenticated with MFA. Option A is correct because such a policy only takes effect once it is attached to the relevant principals — attaching it to all IAM users or to a group that contains all users ensures every user is covered. Option B is not appropriate here because SCPs apply at the AWS Organizations OU/account level and cannot enforce per-IAM-user MFA for console sign-in within a single account. Option D is irrelevant since an account alias only changes the sign-in URL and has no bearing on MFA enforcement. Option E is incorrect because CloudTrail only records API activity for auditing; it does not enforce MFA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach the policy to all IAM users or a group containing all users
Why this is correct
Attaching the policy to every IAM user—or more efficiently, to a group that contains all users—is the only way to make the MFA enforcement policy effective because IAM policies have no effect until they are attached to a principal. Group-based attachment centralizes administration; when a new user is added to the group, the same MFA requirement is automatically inherited. This is the correct deployment step for the policy described in the answer.
- ✗
Create an SCP in AWS Organizations
Why it's wrong here
Service control policies (SCPs) operate at the AWS Organizations account or organizational unit (OU) level, not on individual IAM users, so they cannot evaluate session-specific attributes like aws:MultiFactorAuthPresent. For a single standalone AWS account—which has no organization—SCPs are not even available. Even inside an organization, an SCP can only restrict which AWS services and actions an account can use; it cannot inspect or enforce per-user MFA conditions.
- ✓
Create an IAM policy that uses the aws:MultiFactorAuthPresent condition key to deny access if false
Why this is correct
This IAM policy uses the global condition key aws:MultiFactorAuthPresent in a Deny statement; when the key's value is false, the policy denies every action, thereby overriding any Allow statement. The condition key is populated by AWS based on the authentication context of the request: it is true only when the caller has authenticated with a verified MFA device. This is the precise mechanism that enforces MFA for IAM users, assuming the policy is attached to them as described in the correct answer.
- ✗
Set an account alias for the root user
Why it's wrong here
An account alias only customizes the IAM sign-in URL, turning the default AWS endpoint into a branded URL such as https://yourcompany.signin.aws.amazon.com/. It does not alter authentication requirements or inspect caller credentials, so it cannot force anyone to present an MFA device. MFA enforcement is an identity-policy or SCP matter, not a sign-in endpoint cosmetic setting.
- ✗
Enable CloudTrail to log MFA usage
Why it's wrong here
CloudTrail is an audit service that records API activity, including indications of whether an MFA-authenticated session was used, but it does not intercept or evaluate requests. Logging MFA usage provides evidence after the fact—useful for forensic analysis—but it cannot deny an unauthenticated or non-MFA request. Enforcement requires an IAM policy that actively denies the action; logs are only a passive, post-hoc detection tool.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?
easy- A.Use Amazon Cognito to require MFA for console access.
- ✓ B.Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.
- C.Enable MFA delete on the root account.
- D.Enable MFA on the S3 bucket policy.
Why B: The simplest enforcement is an IAM policy that denies all actions unless the request is made with MFA, attached to users or groups. This uses the aws:MultiFactorAuthPresent condition key in a Deny statement, which blocks console and API access for users who have not authenticated with MFA. It is a native IAM mechanism requiring no additional services.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.