The answer is AWS Config, because it offers a managed rule called `iam-user-mfa-enabled` that continuously evaluates all IAM users against your security policy. This rule automatically detects any user without MFA and can either trigger remediation actions or generate a compliance report through the AWS Config dashboard or Amazon SNS notifications, all with minimal operational overhead. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your ability to choose a fully managed, rule-based evaluation service over manual scripting or third-party tools—a common trap is reaching for AWS Trusted Advisor or IAM Access Analyzer, but those lack the continuous, automated compliance reporting that AWS Config provides. Remember that AWS Config is the go-to service for resource compliance auditing and drift detection, not just for configuration tracking. A useful memory tip: think “Config = Compliance check” and associate the rule name `iam-user-mfa-enabled` with the exam’s focus on automated security enforcement.
SOA-C02 Security and Compliance Practice Question
This SOA-C02 practice question tests your understanding of security and compliance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: aWS Config continuously monitors and records AWS resource configurations.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company's security policy requires that all IAM users must have multi-factor authentication (MFA) enabled. A SysOps administrator needs to automatically detect IAM users without MFA and generate a compliance report. Which AWS service should be used to meet this requirement with minimal operational overhead?
AWS Config has a managed rule for IAM user MFA that can automatically evaluate and report compliance.
B
AWS CloudTrail
Why wrong: CloudTrail logs API calls, but it does not perform configuration compliance checks.
C
IAM Access Analyzer
Why wrong: Access Analyzer is for analyzing resource policies to identify unintended external access, not for checking MFA status.
D
AWS Trusted Advisor
Why wrong: Trusted Advisor checks cost optimization, performance, security, and fault tolerance, but it does not have a specific check for IAM user MFA.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config provides managed rules such as `iam-user-mfa-enabled` that can continuously evaluate IAM users against the requirement for MFA. When a user is found without MFA, AWS Config can trigger an automatic remediation action or generate a compliance report via its dashboard or Amazon SNS notifications, meeting the detection and reporting need with minimal operational overhead.
Key principle: AWS Config continuously monitors and records AWS resource configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
AWS Config
Why this is correct
AWS Config has a managed rule for IAM user MFA that can automatically evaluate and report compliance.
Related concept
AWS Config continuously monitors and records AWS resource configurations.
✗
AWS CloudTrail
Why it's wrong here
CloudTrail logs API calls, but it does not perform configuration compliance checks.
✗
IAM Access Analyzer
Why it's wrong here
Access Analyzer is for analyzing resource policies to identify unintended external access, not for checking MFA status.
✗
AWS Trusted Advisor
Why it's wrong here
Trusted Advisor checks cost optimization, performance, security, and fault tolerance, but it does not have a specific check for IAM user MFA.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse AWS Config's compliance evaluation with CloudTrail's auditing or Trusted Advisor's checks, not realizing that only AWS Config offers a managed rule specifically for IAM user MFA enforcement with automated reporting.
Detailed technical explanation
How to think about this question
AWS Config evaluates resources against rules defined in AWS Lambda functions or managed rules, using a configuration recorder that captures resource state changes. The `iam-user-mfa-enabled` rule checks the `LoginProfile` and `MFADevices` attributes of each IAM user; if a user has a password but no MFA device, the resource is marked noncompliant. This rule can be combined with AWS Config conformance packs to generate aggregated compliance reports across multiple accounts and Regions.
KKey Concepts to Remember
AWS Config continuously monitors and records AWS resource configurations.
AWS Config uses rules to evaluate resource configurations against desired states.
Managed rules in AWS Config are pre-defined by AWS for common compliance checks.
The `iam-user-mfa-enabled` managed rule specifically checks for IAM user MFA compliance.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
AWS Config continuously monitors and records AWS resource configurations.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review aWS Config continuously monitors and records AWS resource configurations., then practise related SOA-C02 questions on the same topic to reinforce the concept.
Security and Compliance — This question tests Security and Compliance — AWS Config continuously monitors and records AWS resource configurations..
What is the correct answer to this question?
The correct answer is: AWS Config — AWS Config provides managed rules such as `iam-user-mfa-enabled` that can continuously evaluate IAM users against the requirement for MFA. When a user is found without MFA, AWS Config can trigger an automatic remediation action or generate a compliance report via its dashboard or Amazon SNS notifications, meeting the detection and reporting need with minimal operational overhead.
What should I do if I get this SOA-C02 question wrong?
Review aWS Config continuously monitors and records AWS resource configurations., then practise related SOA-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
AWS Config continuously monitors and records AWS resource configurations.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.