CLF-C02 Question 103
Single answerYour company uses AWS for its cloud infrastructure. To enhance security, they want to enforce additional authentication for users accessing the AWS Management Console. Which of the following is the best solution to achieve this?
- A
Enable multi-factor authentication (MFA) for all IAM users.
- B
Use cross-account IAM roles to access the AWS Management Console.
- C
Enable AWS IAM Identity Center (formerly AWS SSO) to enforce single sign-on.
- D
Disable root user access to the AWS Management Console.
Show answer and explanation
Correct answer: A
Explanation
Multi-factor authentication (MFA) is a widely recommended security measure in AWS that provides an additional layer of protection. Enabling MFA ensures that even if a user's password is compromised, an attacker cannot access the AWS Management Console without the second authentication factor. This makes it the best solution to enhance authentication security.
- A. Correct.
Enabling multi-factor authentication (MFA) for all IAM users adds an additional layer of security, requiring users to provide a second factor (e.g., a one-time code) along with their password. This is the most effective solution for enhancing authentication security.
- B. Incorrect.
Cross-account IAM roles are used to grant access between AWS accounts but do not specifically enhance authentication for AWS Management Console access.
- C. Incorrect.
AWS IAM Identity Center (SSO) simplifies access management for multiple AWS accounts and third-party applications but does not directly enforce stronger authentication for console access.
- D. Incorrect.
Disabling root user access is a good practice but does not address the requirement for enhancing authentication for general users accessing the AWS Management Console.