AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 179

Question

A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A. A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort. Which solution should the security engineer recommend?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Add an aws MultiFactorAuthPresent condition to the role’s trust policy.

AWS Certified Security - Specialty SCS-C02 — Question 179