How to Centrally Enforce MFA and Disable Access Keys for IAM Users
A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?
Quick Answer
The correct answer is to deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys. This solution works because AWS Organizations allows you to centrally deploy a Config rule to every member account, while custom remediation actions—triggered by Lambda or Systems Manager Automation—can programmatically disable access keys when a non-compliant user is detected. On the SAP-C02 exam, this scenario tests your understanding of how to combine detective controls (Config rules) with automated corrective actions, a pattern that often appears in security governance questions. A common trap is choosing Service Control Policies (SCPs), but SCPs can only deny future API calls if MFA is missing—they cannot disable existing keys or remediate non-compliance. Remember the memory tip: “Config catches, remediation fixes; SCPs block, they don’t disable.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.
Deploying an AWS Config rule across all accounts using AWS Organizations allows centralized detection of IAM users without MFA, and using AWS Config custom remediation can automatically disable their access keys. This meets the requirement for central management from the management account. Option A is incorrect because SCPs can deny API calls if MFA is not present, but they cannot disable access keys. Option C is incorrect because IAM Access Analyzer is used for analyzing access policies and does not have the capability to enforce MFA or disable keys. Option D is incorrect because AWS IAM Identity Center is designed for workforce identity and access management, not for managing existing IAM users in member accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an SCP that denies all API calls if the user does not have an MFA device.
Why it's wrong here
SCPs can deny access, but they cannot disable access keys.
- ✓
Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.
Why this is correct
Config can detect and remediate across accounts.
- ✗
Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.
Why it's wrong here
Access Analyzer is for analyzing resource policies, not for MFA enforcement.
- ✗
Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.
Why it's wrong here
IAM Identity Center does not manage existing IAM users.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?
medium- A.Use AWS Config rules to detect users without MFA and send alerts.
- B.Use AWS CloudTrail to monitor console logins and trigger an automatic remediation.
- C.Create an IAM policy in each account that denies access without MFA.
- ✓ D.Apply a service control policy (SCP) that denies all actions if the user does not have MFA enabled.
Why D: A Service Control Policy (SCP) applied at the root or organizational unit (OU) level in AWS Organizations can centrally deny all AWS API actions for any principal that does not have a multi-factor authentication (MFA) device associated with the session. This enforces MFA across all member accounts without requiring individual account-level IAM policy changes, making it the most efficient and scalable solution for the security team's requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.