Multi-factor authentication setup in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of enabling MFA on an AWS root account?

Why should you enable Multi-factor Authentication (MFA) on the AWS root account?

A To enable automatic backup of all AWS resources.

B To allow multiple users to share the root account credentials safely.

C To automatically reset the root account password every 30 days.

D To add an extra layer of security by requiring a second form of verification during login.

💡 Hint

Think about how MFA helps protect accounts beyond just a password.

Enabling MFA adds a second verification step, making it harder for unauthorized users to access the root account even if they know the password.

❓ Configuration

intermediate

Which AWS CLI command correctly enables a virtual MFA device for a user?

Choose the AWS CLI command that correctly associates a virtual MFA device with an IAM user named 'alice'.

A aws iam attach-mfa-device --user alice --device arn:aws:iam::123456789012:mfa/alice

B aws iam create-virtual-mfa-device --virtual-mfa-device-name alice --outfile /path/to/qr-code.png

C aws iam enable-mfa-device --user-name alice --serial-number arn:aws:iam::123456789012:mfa/alice --authentication-code1 123456 --authentication-code2 654321

D aws iam set-mfa --username alice --device-arn arn:aws:iam::123456789012:mfa/alice

💡 Hint

Look for the command that enables MFA with authentication codes.

The enable-mfa-device command links the MFA device to the user by providing two consecutive authentication codes from the device.

❓ security

advanced

What happens if an IAM user tries to access AWS resources without MFA when a policy requires MFA?

An IAM policy requires MFA for accessing S3 buckets. What is the result if the user tries to access the bucket without MFA?

A Access is granted but with read-only permissions.

B Access is denied because the policy condition requiring MFA is not met.

C Access is granted normally without any restrictions.

D The user is prompted to set up MFA before access is allowed.

💡 Hint

Consider how IAM policies enforce conditions.

If the policy requires MFA and the user is not authenticated with MFA, AWS denies access to the resource.

❓ service_behavior

advanced

How does AWS handle MFA device removal for an IAM user when the device is lost?

If an IAM user loses their MFA device, what is the recommended AWS process to restore access?

A An administrator must deactivate the lost MFA device and assign a new one to the user.

B The user can reset the MFA device themselves via the AWS Management Console without admin help.

C The user can continue accessing resources without MFA once the device is lost.

D AWS automatically disables MFA after 24 hours of inactivity.

💡 Hint

Think about who controls MFA device management for IAM users.

Only an administrator can remove or deactivate the lost MFA device and assign a new one to maintain security.

❓ Architecture

expert

Designing MFA enforcement for a multi-account AWS environment

You manage multiple AWS accounts linked via AWS Organizations. You want to enforce MFA for all IAM users across all accounts without manually configuring each account. Which AWS feature or approach achieves this most effectively?

A Use AWS Organizations Service Control Policies (SCPs) to require MFA for all IAM users in member accounts.

B Manually enable MFA on each IAM user in every account using the AWS Management Console.

C Create a Lambda function that scans accounts and enables MFA devices automatically.

D Rely on IAM password policies to enforce MFA usage.

💡 Hint

Consider centralized policy enforcement across multiple accounts.

AWS Organizations SCPs allow you to centrally enforce policies like requiring MFA across all member accounts, preventing users from bypassing MFA.