SOA-C02 Security and Compliance Practice Question

A company's security policy requires that all IAM users must authenticate using multi-factor authentication (MFA) before accessing the Amazon S3 bucket containing confidential finance data. The SysOps administrator needs to create an IAM policy that denies access to the S3 bucket if the user has not authenticated using MFA. Which IAM condition key should the administrator include in the policy?

⚠ Common exam trap

A common mix-up: candidates confuse `aws:MultiFactorAuthPresent` with `aws:MultiFactorAuthAge` or assume that simply having MFA enabled on the user account automatically sets the key, when in fact the key is only present if MFA was used during the current session authentication.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

aws:MultiFactorAuthPresent

The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the requesting IAM user has authenticated using a valid MFA device. By including this key in a `Deny` statement with a condition that it is `false`, the policy effectively blocks any S3 access unless MFA was used. This directly enforces the security policy requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
aws:MultiFactorAuthPresent
Why this is correct
aws:MultiFactorAuthPresent is a Boolean global condition key that is populated in the request context after authentication. It evaluates to true only when the principal authenticated with a valid MFA device, such as a hardware token or virtual MFA application. In an IAM policy, you can write a Deny statement using this key with a BoolIfExists condition to explicitly block requests that did not use MFA, which directly satisfies the security requirement. Because it reflects the MFA authentication state itself, it is the correct condition key to enforce this policy.
✗
aws:UserAgent
Why it's wrong here
aws:UserAgent is a global condition key that inspects the User-Agent HTTP header sent by the client, identifying the application or SDK version making the AWS request. While it can be used to allow or deny access based on the client tool, such as blocking requests from the AWS Console or a specific CLI version, it provides no information about whether MFA was used. An attacker can spoof the User-Agent string, so relying on it to enforce MFA would be both insecure and ineffective. Therefore, this key does not satisfy the MFA requirement.
✗
aws:SourceIp
Why it's wrong here
aws:SourceIp evaluates the source IP address from which the request originates and is typically used to restrict access to trusted network ranges, such as a corporate VPN or office CIDR block. It is an attribute of the network connection, not of the authenticated identity's authentication factors, so it cannot verify whether MFA was presented. A user could connect from an allowed IP without ever providing an MFA code, and a denied IP would block access even if the user did use MFA. This makes it an inappropriate condition key for enforcing MFA.
✗
aws:RequestedRegion
Why it's wrong here
aws:RequestedRegion is a global condition key that returns the AWS Region code (for example, us-east-1) to which the API request was directed, allowing policies to restrict access to specific geographic regions. It is useful for data-residency controls or preventing accidental use of non-approved regions, but it has no relationship to the authentication process. MFA status is determined at login and signaled by a separate condition key, while RequestedRegion simply reflects the regional endpoint chosen by the client. Thus, it cannot enforce the company's MFA policy.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question