Enforce MFA for IAM Users: Steps for Console Access
A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?
Quick Answer
The answer is to enable MFA on each IAM user and attach an IAM policy that denies all actions unless the request includes MFA, using the condition key aws:MultiFactorAuthPresent. This two-step approach works because the policy condition evaluates every API call: if the user has not authenticated with a valid MFA device, the condition fails and the request is denied, effectively enforcing MFA for console access. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of identity-based policies versus service control policies—a common trap is choosing SCPs, but those apply at the account or OU level, not per user. Remember that enabling MFA alone does nothing without a policy to block non-MFA sessions. Memory tip: think "Enable + Enforce" — first turn on the device, then lock the door with the condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MFA devices for each IAM user.
To enforce MFA, each IAM user must have an MFA device enabled. Option C is correct because attaching an IAM policy with a condition that denies all actions unless aws:MultiFactorAuthPresent is true ensures that users must authenticate with MFA to perform any action. Option B is incorrect because service control policies (SCPs) are used in AWS Organizations to manage permissions across accounts, not for individual user-level MFA enforcement. Option D is incorrect because enabling MFA for the root user only does not enforce MFA for all IAM users. Option E is incorrect because an IAM password policy controls password complexity and rotation, not MFA requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable MFA devices for each IAM user.
Why this is correct
Users must have MFA devices assigned.
- ✗
Use a service control policy (SCP) to require MFA for all users.
Why it's wrong here
SCPs cannot enforce MFA at the user level; they only limit permissions.
- ✓
Attach an IAM policy that denies all actions unless the request includes MFA (condition aws:MultiFactorAuthPresent).
Why this is correct
This policy denies access if MFA is not used.
- ✗
Enable MFA for the root user only.
Why it's wrong here
Root user MFA is important but does not enforce MFA for other users.
- ✗
Configure an IAM password policy that requires MFA.
Why it's wrong here
Password policy does not enforce MFA usage.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to enforce that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. What is the best way to achieve this?
easy- A.Enable MFA in the account settings.
- ✓ B.Attach an IAM policy to all users that denies console access without MFA.
- C.Set a password policy that requires MFA.
- D.Use an SCP to deny access if MFA is not present.
Why B: An IAM policy with a condition that denies console access unless MFA is present enforces MFA for all IAM users. Option A is incorrect because account settings do not enforce MFA for individual users. Option C is incorrect because a password policy cannot require MFA. Option D is incorrect because SCPs apply to accounts or OUs, not to individual IAM users, and are not the best way to enforce MFA per user.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.