SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?
⚠ Common exam trap
A common mix-up: candidates confuse detective controls (like AWS Config alerts) with preventive controls (like SCPs), or mistakenly think IAM password policies can enforce MFA, when in fact password policies only govern password characteristics, not multi-factor authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP that denies all actions if the principal does not have MFA.
Service Control Policies (SCPs) in AWS Organizations can enforce preventive security controls across all accounts in the organization. By denying all actions when a principal does not have MFA, the SCP effectively blocks any API call from IAM users or roles that haven't authenticated with MFA, ensuring compliance at the organizational level regardless of individual account configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to detect users without MFA and send alerts.
Why it's wrong here
Reactive, does not enforce.
- ✗
Use AWS CloudTrail to monitor and disable users without MFA.
Why it's wrong here
Cannot enforce.
- ✗
Set an IAM password policy that requires MFA for all users.
Why it's wrong here
Password policy does not enforce MFA usage.
- ✓
Apply an SCP that denies all actions if the principal does not have MFA.
Why this is correct
Forces MFA for all API calls.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?
hard- A.Enable CloudTrail to log all console logins and alert if MFA is not used.
- ✓ B.Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.
- ✓ C.Use AWS Config rules to detect IAM users without MFA and automatically remediate by sending notifications.
- D.Use a service control policy (SCP) to require MFA on all IAM users.
- ✓ E.Create an IAM policy that requires MFA for ConsoleLogin and attach it to all IAM users in each account.
Why B: AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.