SCS-C02 Management and Security Governance Practice Question
A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the organization have multi-factor authentication (MFA) enabled. Which combination of actions should be taken to enforce this requirement?
⚠ Common exam trap
The trap here is that candidates mistakenly think SCPs can be attached to IAM users or groups, but SCPs are organization-level policies that only apply to OUs, accounts, or the root, not to individual IAM entities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).
Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.
Why it's wrong here
Service control policies are AWS Organizations-level policies and can be attached only to the organization root, OUs, or member accounts; an IAM group is an identity construct inside a single account and is not a valid SCP attachment target. Because SCPs do not bind to IAM groups, this approach cannot define an organization-wide MFA permission guardrail for users in every account.
- ✓
Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).
Why this is correct
Attaching the SCP to the root organizational unit places it in the hierarchy of every OU and member account in the organization, so the deny rule with aws:MultiFactorAuthPresent applies to every IAM user in those accounts. Because a root-level SCP is evaluated as an organizational permission boundary before IAM authorization, an IAM action without MFA is blocked throughout the member accounts.
- ✗
Create an SCP that denies IAM actions without MFA and attach it to each IAM user.
Why it's wrong here
SCPs are attached to AWS Organizations entities such as roots, OUs, or accounts, and never to individual IAM users, because IAM principals are not objects that an SCP can target. An IAM user is an account-level identity, and AWS Organizations has no API to attach an SCP to a user entity, so this approach is invalid and would not enforce any MFA restriction.
- ✗
Create an SCP that denies IAM actions without MFA and attach it to the management account.
Why it's wrong here
The management account is the organization's administrative account and is not subject to service control policies, so an SCP on the management account cannot limit member account IAM users, and it also cannot affect the management account's own principals. Since SCPs must be attached to the root or to member accounts to govern member accounts, this option leaves the rest of the organization without MFA enforcement.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.