Enforce MFA Using Service Control Policies

Quick Answer

For a service control policy to actually enforce an MFA requirement across an organization, two separate conditions both have to be true, and the question tests whether you understand that an SCP needs the right condition logic and the right placement to be effective. The condition logic comes from the aws:MultiFactorAuthPresent context key, which an SCP can check to deny actions when the requesting principal has not authenticated with MFA, giving the policy something concrete to evaluate rather than a vague intent. The placement comes from where the SCP is attached: because SCPs only apply to accounts within the organizational unit they're attached to, attaching the policy to the root OU is what makes it apply organization-wide rather than to just one branch of accounts. It's worth being precise about what SCPs can and cannot do: they can conditionally deny access based on whether MFA was present at the time of the request, but they cannot force a user to register MFA in the first place, and they attach to organizational units or accounts, never to individual IAM users directly. Whenever a question describes enforcing a security requirement organization-wide through an SCP, check for both pieces together, the condition key that captures the requirement and the attachment point high enough in the OU hierarchy to cover every account that needs governing.