SCS-C02 Question 414
Select 2Your organization is undergoing a security compliance audit and needs to ensure that all IAM users have multi-factor authentication (MFA) enabled. As a security engineer, you want to implement a solution that continuously enforces this requirement and remediates non-compliant users automatically. Which combination of actions would BEST achieve this?
- A
Create an AWS Config rule to check whether IAM users have MFA enabled.
- B
Set up an Amazon EventBridge rule to trigger a Lambda function when users without MFA are detected.
- C
Use AWS Organizations Service Control Policies (SCPs) to enforce MFA for all accounts in the organization.
- D
Write an AWS Identity and Access Management (IAM) policy that denies all actions for users without MFA enabled.
- E
Configure AWS Config to automatically remediate non-compliant users by attaching a deny-all policy to their accounts when MFA is disabled.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure IAM users have MFA enabled and automate remediation, AWS Config should first monitor the compliance status using the 'iam-user-mfa-enabled' rule. Then, Amazon EventBridge can trigger a Lambda function whenever non-compliance is detected, allowing for actions such as notifying the user or restricting access. SCPs are not applicable for enforcing user-specific settings, and IAM policies do not provide dynamic enforcement capabilities for MFA.
- A. Correct.
Correct. AWS Config can monitor compliance by using a managed rule such as 'iam-user-mfa-enabled' to check whether all IAM users have MFA enabled.
- B. Correct.
Correct. Amazon EventBridge can trigger a Lambda function whenever a non-compliant user is detected. The Lambda function can then remediate by notifying the user or taking appropriate action.
- C. Incorrect.
Incorrect. Service Control Policies (SCPs) cannot enforce MFA directly. SCPs control permissions at the account level but cannot enforce user-specific configurations like MFA.
- D. Incorrect.
Incorrect. IAM policies cannot dynamically enforce MFA. While policies can enforce MFA for specific actions, they cannot automatically identify users without MFA enabled.
- E. Incorrect.
Incorrect. AWS Config does not have built-in functionality to automatically attach IAM policies for remediation. Custom logic via Lambda is required for such actions.