SOA-C02 Security and Compliance Practice Question

A company's security policy requires that the AWS account root user must have multi-factor authentication (MFA) enabled. A SysOps administrator needs to continuously verify compliance and automatically notify the security team if the root user is not configured with MFA. Which AWS service can be used to create a compliance rule for this requirement?

⚠ Common exam trap

Watch out — candidates often confuse AWS Trusted Advisor's security checks (which include a root MFA check but lack continuous evaluation and automated notification) with AWS Config's managed rules that provide ongoing compliance monitoring and event-driven alerts.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Config with the managed rule 'root-account-mfa-enabled'

AWS Config provides a managed rule called 'root-account-mfa-enabled' that continuously evaluates whether the root user has an MFA device configured. When the rule detects non-compliance, it can trigger an Amazon SNS notification to alert the security team, meeting the requirement for automated compliance verification and alerting.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor does include a security check that reports whether multi-factor authentication (MFA) is enabled on the AWS account root user, but this check is only visible in the Trusted Advisor dashboard and must be accessed manually. It does not provide a way to trigger automatic notifications, run compliance history, or integrate with SNS/EventBridge when the root account falls out of compliance. Therefore, while it has similar information, it is not a suitable continuous compliance monitoring service for this security policy requirement.
✓
AWS Config with the managed rule 'root-account-mfa-enabled'
Why this is correct
AWS Config with the managed rule 'root-account-mfa-enabled' continuously evaluates the root user's MFA configuration against the rule's desired state. When the root account becomes non-compliant, AWS Config can publish configuration change notifications to Amazon SNS via EventBridge, allowing automated alerting and remediation. This rule is available as a managed rule and works across all supported regions and accounts with minimal setup, making it the correct choice for verifying and monitoring root MFA compliance.
✗
AWS Identity and Access Management (IAM) Access Analyzer
Why it's wrong here
IAM Access Analyzer is designed to analyze resource-based policies (such as S3 bucket policies, KMS key policies, and IAM roles) to identify resources shared with external principals. It does not examine the configuration of the root user or other IAM principals, such as whether MFA is enabled. Instead of checking compliance with security best practices like root MFA, it focuses on external access risks, so it cannot answer this security policy's requirement.
✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that performs automated security assessments of compute workloads, such as EC2 instances and container images. It scans for software vulnerabilities, unintended network exposure, and deviations from CIS benchmarks, but it has no visibility into AWS account-level settings like MFA on the root user. Since it does not evaluate IAM or identity configurations, it cannot be used to verify root account MFA for compliance.

Go deeper

SOA-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question