DOP-C02 Security and Compliance Practice Question
A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the policy to all IAM users or a group containing all users
To enforce MFA, you need an IAM policy that denies actions if MFA is not present, and you must attach that policy to all users or a group. Creating an SCP can enforce across accounts but is not needed for single account. CloudTrail does not enforce. Account alias is unrelated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach the policy to all IAM users or a group containing all users
Why this is correct
Attaching the policy to every IAM user—or more efficiently, to a group that contains all users—is the only way to make the MFA enforcement policy effective because IAM policies have no effect until they are attached to a principal. Group-based attachment centralizes administration; when a new user is added to the group, the same MFA requirement is automatically inherited. This is the correct deployment step for the policy described in the answer.
- ✗
Create an SCP in AWS Organizations
Why it's wrong here
Service control policies (SCPs) operate at the AWS Organizations account or organizational unit (OU) level, not on individual IAM users, so they cannot evaluate session-specific attributes like aws:MultiFactorAuthPresent. For a single standalone AWS account—which has no organization—SCPs are not even available. Even inside an organization, an SCP can only restrict which AWS services and actions an account can use; it cannot inspect or enforce per-user MFA conditions.
- ✓
Create an IAM policy that uses the aws:MultiFactorAuthPresent condition key to deny access if false
Why this is correct
This IAM policy uses the global condition key aws:MultiFactorAuthPresent in a Deny statement; when the key's value is false, the policy denies every action, thereby overriding any Allow statement. The condition key is populated by AWS based on the authentication context of the request: it is true only when the caller has authenticated with a verified MFA device. This is the precise mechanism that enforces MFA for IAM users, assuming the policy is attached to them as described in the correct answer.
- ✗
Set an account alias for the root user
Why it's wrong here
An account alias only customizes the IAM sign-in URL, turning the default AWS endpoint into a branded URL such as https://yourcompany.signin.aws.amazon.com/. It does not alter authentication requirements or inspect caller credentials, so it cannot force anyone to present an MFA device. MFA enforcement is an identity-policy or SCP matter, not a sign-in endpoint cosmetic setting.
- ✗
Enable CloudTrail to log MFA usage
Why it's wrong here
CloudTrail is an audit service that records API activity, including indications of whether an MFA-authenticated session was used, but it does not intercept or evaluate requests. Logging MFA usage provides evidence after the fact—useful for forensic analysis—but it cannot deny an unauthenticated or non-MFA request. Enforcement requires an IAM policy that actively denies the action; logs are only a passive, post-hoc detection tool.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?
easy- A.Use Amazon Cognito to require MFA for console access.
- ✓ B.Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.
- C.Enable MFA delete on the root account.
- D.Enable MFA on the S3 bucket policy.
Why B: Creating an IAM policy that denies all actions unless MFA is present, then attaching it to all IAM users or groups, is the simplest way to enforce MFA for console access. This uses the `aws:MultiFactorAuthPresent` condition key to require MFA. Option A is incorrect because Amazon Cognito is used for application-level authentication, not AWS IAM console access. Option C is incorrect because MFA delete on the root account only protects S3 versioning, not console access. Option D is incorrect because S3 bucket policies cannot enforce MFA for console login.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.