CLF-C02 Question 105
Select 2A company wants to provide secure access to its AWS Management Console for employees. They require users to authenticate using their corporate credentials and, for added security, implement multi-factor authentication. Which combination of AWS services and features can fulfill this requirement?
- A
Enable AWS IAM Identity Center (AWS Single Sign-On) and configure it to integrate with the corporate identity provider
- B
Enable MFA for users in the AWS Management Console
- C
Create cross-account IAM roles for all users to access AWS resources from their corporate accounts
- D
Use IAM policies to restrict access to AWS Management Console and require MFA
- E
Set up an Amazon Cognito user pool for authentication
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of using corporate credentials for authentication and implementing multi-factor authentication, the company needs to integrate AWS IAM Identity Center with their corporate identity provider and enable MFA for users. AWS IAM Identity Center supports integration with external identity providers for corporate credentials, while enabling MFA ensures additional security during the login process.
- A. Correct.
Enabling AWS IAM Identity Center allows integration with the corporate identity provider, enabling users to authenticate using their corporate credentials. This meets the requirement for corporate credential-based authentication.
- B. Correct.
Enabling MFA adds an additional layer of security, meeting the requirement for multi-factor authentication in the AWS Management Console.
- C. Incorrect.
Cross-account IAM roles are used for granting access between AWS accounts, not for enabling authentication with corporate credentials or MFA.
- D. Incorrect.
IAM policies can enforce MFA for access to AWS resources but do not directly handle integration with corporate credentials for authentication.
- E. Incorrect.
Amazon Cognito is used primarily for building authentication mechanisms for web and mobile applications, not for AWS Management Console access with corporate credentials.