SAA-C03 Design Secure Architectures Practice Question
An administrator needs the ability to read and update infrastructure for a specific AWS account, but only when using MFA. The security team wants to eliminate long-lived administrator access keys and ensure that even if someone obtains temporary session credentials, actions are only allowed with MFA present.
Which IAM design best meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse requiring MFA at login (console) with enforcing MFA for all API calls, failing to realize that without a condition key in the IAM policy, access keys or temporary credentials can be used without MFA after the initial login.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.
It uses an IAM role with a condition key `aws:MultiFactorAuthPresent` set to `true` to enforce MFA for all API calls made with temporary credentials. This eliminates long-lived access keys and ensures that even if temporary session credentials are compromised, actions are denied unless MFA was used during the session. The policy explicitly denies all allowed actions when MFA is not present, meeting the security team's requirement for MFA on every administrative action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM user for administrators with AdministratorAccess and require MFA only at the IAM user login.
Why it's wrong here
AdministratorAccess grants too much privilege and still relies on long-lived access keys. MFA at login does not prevent use of existing sessions without MFA constraints.
When this WOULD be correct
This option would be correct if the requirement was simply to require MFA for console access and the administrator uses long-lived access keys for programmatic access without needing MFA enforcement for API calls.
- ✓
Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.
Why this is correct
A role-based approach removes long-lived keys and supports temporary credentials. Using a permissions-policy condition to require MFA presence enforces that the session must have MFA to perform actions, aligning with the “actions only allowed with MFA present” requirement.
- ✗
Attach policies to an IAM user that allow read/write actions and enable MFA in the account, but do not use condition keys in IAM policies.
Why it's wrong here
Enabling MFA at the account level is not the same as enforcing MFA presence for each API call. Without condition keys, sessions may still be used without MFA constraints.
When this WOULD be correct
If the requirement were only to enforce MFA for console login (not for programmatic access or API calls), and long-lived access keys were acceptable, then attaching policies to an IAM user with MFA enabled at the account level would suffice.
- ✗
Use a role with the correct actions but enforce MFA only in the application by prompting users for an OTP before every API call.
Why it's wrong here
Client-side enforcement is not reliable and can be bypassed. Security should be enforced at the IAM policy layer using condition keys to control authorization.
When this WOULD be correct
If the requirement was to enforce MFA only for application-level API calls (e.g., a custom web app) and not for other AWS access methods, and the application already handles MFA separately, then this design could be acceptable.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.Correct answer▾
Why this is correct
A role-based approach removes long-lived keys and supports temporary credentials. Using a permissions-policy condition to require MFA presence enforces that the session must have MFA to perform actions, aligning with the “actions only allowed with MFA present” requirement.
✗Create an IAM user for administrators with AdministratorAccess and require MFA only at the IAM user login.Wrong answer — click to see why▾
Why this is wrong here
Option A only requires MFA at login, but does not enforce MFA for API calls made with temporary credentials, allowing actions without MFA if session credentials are obtained.
★ When this WOULD be the correct answer
This option would be correct if the requirement was simply to require MFA for console access and the administrator uses long-lived access keys for programmatic access without needing MFA enforcement for API calls.
Why candidates choose this
Candidates may think that enabling MFA on the IAM user account globally protects all actions, not realizing that MFA at login does not extend to API calls made with access keys or temporary credentials.
✗Attach policies to an IAM user that allow read/write actions and enable MFA in the account, but do not use condition keys in IAM policies.Wrong answer — click to see why▾
Why this is wrong here
This option does not use a condition key in IAM policies to require MFA for API calls, so temporary session credentials obtained without MFA could still perform actions. It only enforces MFA at login, not for subsequent API operations.
★ When this WOULD be the correct answer
If the requirement were only to enforce MFA for console login (not for programmatic access or API calls), and long-lived access keys were acceptable, then attaching policies to an IAM user with MFA enabled at the account level would suffice.
Why candidates choose this
Candidates may think that enabling MFA on the account or user automatically protects all actions, not realizing that IAM condition keys are needed to enforce MFA for API calls made with temporary credentials.
✗Use a role with the correct actions but enforce MFA only in the application by prompting users for an OTP before every API call.Wrong answer — click to see why▾
Why this is wrong here
Enforcing MFA only at the application level (via OTP prompt) does not prevent actions taken through other means like AWS CLI or SDK, and does not use IAM condition keys to enforce MFA for all API calls, leaving a security gap.
★ When this WOULD be the correct answer
If the requirement was to enforce MFA only for application-level API calls (e.g., a custom web app) and not for other AWS access methods, and the application already handles MFA separately, then this design could be acceptable.
Why candidates choose this
Candidates may think that application-level MFA enforcement is sufficient and simpler to implement, overlooking that IAM policies must enforce MFA at the API level to cover all access methods.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.