CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Security - Specialty Exam Question Walkthrough
Learn how to tackle MFA enforcement questions for the AWS Certified Security - Specialty exam with this detailed walkthrough.
Multi-factor authentication (MFA) is crucial for securing AWS accounts. Candidates often struggle with questions about enforcing MFA across multiple users. This decision is critical for maintaining a strong security posture across the organization.
The question
Your organization requires multi-factor authentication (MFA) for all IAM users to enhance security. What is the most effective way to enforce this requirement across the AWS account?
- A. Enable MFA on the root account only.
- B. Create an IAM policy that requires MFA for all users.
- C. Enforce MFA through AWS Organizations Service Control Policies (SCPs).
- D. Require users to configure MFA manually through the AWS Management Console.
Think before you scroll
Consider the implications of each option. Some methods may be limited in scope or effectiveness. The goal is to ensure that every IAM user in the organization is compliant with the MFA requirement.
The answer
The correct option is C. Enforce MFA through AWS Organizations Service Control Policies (SCPs). This approach allows you to consistently apply the MFA requirement across all accounts in your organization.
Why the other options lose
- A. Enable MFA on the root account only. This option is inadequate because it only protects the root account and does not enforce MFA for all IAM users. The root account should have MFA enabled, but not exclusively for MFA enforcement.
- B. Create an IAM policy that requires MFA for all users. While this option can enforce MFA, it is limited to specific IAM users within a single account. It does not apply organization-wide, making it less effective for comprehensive security.
- D. Require users to configure MFA manually through the AWS Management Console. This approach relies on user compliance, which can lead to inconsistencies. Not all users may configure MFA, leaving some accounts vulnerable.
The concept behind it
Enforcing security policies at the organizational level is key to maintaining a uniform security posture. AWS Organizations allows you to apply Service Control Policies (SCPs) that govern what actions can be performed across all accounts, ensuring compliance with security requirements like MFA.
Exam trap to remember
Remember: SCPs enforce policies across multiple accounts, while IAM policies are account-specific.