SAA-C03 · Question #210
A company is implementing a new policy to enhance the security of its AWS environment. The policy requires all administrative actions that users perform on the AWS Management Console to be secured…
The correct answer is B. Create an IAM policy that requires MFA to be enabled for the IAM roles that administrators. Enforce MFA for all administrative actions on the AWS Management Console in an operationally efficient way.
Question
A company is implementing a new policy to enhance the security of its AWS environment. The policy requires all administrative actions that users perform on the AWS Management Console to be secured by multi-factor authentication (MFA). Which solution will allow the company to enforce this policy in the MOST operationally efficient way?
Options
- AEnable MFA on the root account. Ensure that all administrators use the root account to perform
- BCreate an IAM policy that requires MFA to be enabled for the IAM roles that administrators
- CConfigure an Amazon CloudWatch alarm that sends an email notification when an administrator
- DUse AWS Config to periodically audit IAM users and to automatically attach an IAM policy that
How the community answered
(41 responses)- A2% (1)
- B93% (38)
- C5% (2)
Why each option
Enforce MFA for all administrative actions on the AWS Management Console in an operationally efficient way.
Using the root account for daily administrative tasks is a critical security anti-pattern due to its unrestricted permissions and should be avoided.
An IAM policy with a `aws:MultiFactorAuthPresent` condition can directly enforce that administrative actions are only allowed when MFA was used for authentication, applying real-time enforcement for administrators who assume specified roles.
A CloudWatch alarm only provides notifications *after* a non-MFA action might have occurred, failing to prevent the unauthorized action in real-time.
AWS Config is a reactive auditing tool that can identify non-compliant users and potentially trigger remediation, but it's less efficient than a proactive IAM policy that prevents non-MFA actions from the outset.
Concept tested: Enforcing MFA with IAM policies
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multiauth
Community Discussion
No community discussion yet for this question.