SOA-C02 · Question #136
A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However. users are not prompted to enter MFA tokens…
The correct answer is D. Require users to use temporary credentials from the get-session token command to sign API. The most appropriate step to ensure that API calls are authenticated using MFA is to require users to use temporary credentials from the get-session token command to sign API calls. This is because the get-session token command returns temporary security credentials consisting…
Question
A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However. users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA. What additional step must be taken to ensure that API calls are authenticated using MFA?
Options
- AEnable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.
- BAsk the IAM users to log into the AWS Management Console with MFA before making API
- CRestrict the IAM users to use of the console, as MFA is not supported for CLI use.
- DRequire users to use temporary credentials from the get-session token command to sign API
How the community answered
(45 responses)- A13% (6)
- B7% (3)
- C4% (2)
- D76% (34)
Explanation
The most appropriate step to ensure that API calls are authenticated using MFA is to require users to use temporary credentials from the get-session token command to sign API calls. This is because the get-session token command returns temporary security credentials consisting of an access key ID, a secret access key, and a session token that are valid only for a limited period of time. These credentials can be used to make API calls with MFA authentication. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-
Topics
Community Discussion
No community discussion yet for this question.