SCS-C02 · Question #438
A consultant agency needs to perform a security audit for a company's production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account…
The correct answer is D. Create an IAM role in the company's production account. Define a trust policy that requires MFA. To allow consultants from an external AWS account to access the production account while enforcing MFA and avoiding long-term credentials, you should create an IAM role in the production account and establish a trust relationship with the consultant's AWS account. This trust…
Question
A consultant agency needs to perform a security audit for a company's production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials. Which solution will provide the consultant agency with access that meets these requirements?
Options
- ACreate an IAM group. Create an IAM user for each consultant. Add each user to the group.
- BConfigure Amazon Cognito on the company's production account to authenticate against the
- CCreate an IAM role in the consultant agency's AWS account. Define a trust policy that requires
- DCreate an IAM role in the company's production account. Define a trust policy that requires MFA.
How the community answered
(64 responses)- A5% (3)
- B3% (2)
- C8% (5)
- D84% (54)
Explanation
To allow consultants from an external AWS account to access the production account while enforcing MFA and avoiding long-term credentials, you should create an IAM role in the production account and establish a trust relationship with the consultant's AWS account. This trust policy will require MFA, and the role can be assumed by users in the consultant agency's
Topics
Community Discussion
No community discussion yet for this question.