SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?
⚠ Common exam trap
Test-takers frequently confuse detection (CloudTrail) with enforcement (SCP or IAM policy), or they assume that assigning an MFA device is sufficient without a corresponding deny policy, leading them to pick options that only monitor or partially enforce the requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.
AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to centrally enforce that any API action is denied unless the request includes MFA. By using the `aws:MultiFactorAuthPresent` condition key set to `false`, the SCP effectively blocks all AWS actions (including console login) for any principal that has not authenticated with MFA. This ensures a blanket, unmodifiable guard across all member accounts, even preventing account administrators from bypassing the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS CloudTrail to detect console logins without MFA and send alerts.
Why it's wrong here
This is detective, not preventive.
- ✓
Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.
Why this is correct
This denies actions when MFA is not used.
- ✗
Require each IAM user to have a virtual MFA device assigned.
Why it's wrong here
This does not enforce use of MFA.
- ✗
Create an IAM group for users without MFA and deny them console access.
Why it's wrong here
This does not enforce MFA; users could still be in other groups.
- ✓
Attach an IAM policy to all users that denies console access if MFA is not present.
Why this is correct
This policy denies console access without MFA.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.