Enforce MFA for IAM Users
A company wants to enforce that all IAM users in its AWS account use multi-factor authentication (MFA) for console login. Which action should be taken to ensure compliance?
Quick Answer
The correct action is to create an IAM policy that denies access unless MFA is present and attach it to all IAM users. This works because the policy uses a condition key, `aws:MultiFactorAuthPresent`, to check whether the user authenticated with a valid MFA token; if the condition evaluates to false, the policy explicitly denies all API actions, effectively enforcing MFA for console login. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of identity-based policies versus service control policies or password policies—common traps include confusing SCPs, which operate at the account level and cannot enforce MFA per user, or assuming the password policy can mandate MFA. Remember that MFA enforcement is a permission boundary, not a password rule. A useful memory tip: think “Deny unless MFA present” as the only way to lock down individual users, and keep in mind that the root user’s MFA is a separate security best practice, not an enforcement mechanism for all IAM users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM policy that denies access unless MFA is present and attach it to all IAM users.
The correct action is to create an IAM policy that denies access unless MFA is present and attach it to all IAM users. This policy uses a condition key like 'aws:MultiFactorAuthPresent' to block API calls when MFA is not used, effectively enforcing MFA for console login. Option A is incorrect because service control policies (SCPs) apply at the AWS Organizations level, not to individual IAM users, and cannot enforce MFA on console login. Option C is wrong because sharing root user credentials violates security best practices and does not enforce MFA for each user. Option D is incorrect because AWS account password policies do not include an MFA requirement; they only manage password complexity and rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply an SCP to the AWS account that mandates MFA for all users.
Why it's wrong here
Incorrect: SCPs apply to AWS accounts and OUs, not to individual IAM users.
- ✓
Create an IAM policy that denies access unless MFA is present and attach it to all IAM users.
Why this is correct
Correct: IAM policies can use conditions to require MFA for access.
- ✗
Enable MFA on the root user and share credentials with all users.
Why it's wrong here
Incorrect: Root user MFA does not enforce MFA for IAM users.
- ✗
Configure the account password policy to require MFA.
Why it's wrong here
Incorrect: Password policy does not enforce MFA; it only sets password requirements.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to enforce that all IAM users in an AWS account must have multi-factor authentication (MFA) enabled. Which AWS service can be used to automatically detect and remediate non-compliant users?
medium- A.AWS Trusted Advisor
- B.AWS IAM Access Analyzer
- C.AWS CloudTrail
- ✓ D.AWS Config
Why D: AWS Config can evaluate IAM user MFA status using a managed rule (iam-user-mfa-enabled) and trigger automatic remediation via Systems Manager Automation or Lambda.
Variation 2. A company wants to ensure that all IAM users in an account have multi-factor authentication (MFA) enabled. A security administrator needs to identify users who do not have MFA. Which AWS service should the administrator use?
easy- A.AWS CloudTrail
- B.IAM Access Analyzer
- ✓ C.IAM Credential Report
- D.AWS Config
Why C: AWS IAM Credential Report lists all IAM users and their MFA status, providing a quick way to identify users without MFA. Option A (AWS CloudTrail) logs API events, not MFA status. Option B (IAM Access Analyzer) focuses on resource policies. Option D (AWS Config) can check compliance but requires a rule; the credential report is more direct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.