Multi-factor authentication setup in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable MFA device for an IAM user.

AWS

aws iam enable-mfa-device --user-name [1] --serial-number arn:aws:iam::123456789012:mfa/[1] --authentication-code1 123456 --authentication-code2 789012

Drag options to blanks, or click blank then click option'

ADavid

BAlice

CBob

DCharlie

Attempts:

3 left

💡 Hint

Common Mistakes

Using different user names in --user-name and --serial-number

Typing the wrong user name

The --user-name and --serial-number must match the IAM user name. Here, 'Bob' is the correct user to enable MFA.

2fill in blank

medium

Complete the code to create a virtual MFA device named 'MyDevice'.

AWS

aws iam create-virtual-mfa-device --virtual-mfa-device-name [1] --outfile MyDeviceQRCode.png

Drag options to blanks, or click blank then click option'

AVirtualMFA

BMyDevice

CMFADevice

DDevice1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different device name than instructed

Misspelling the device name

The --virtual-mfa-device-name should be the name you want to assign. 'MyDevice' matches the instruction.

3fill in blank

hard

Fix the error in the command to deactivate the MFA device for user 'Eve'.

AWS

aws iam deactivate-mfa-device --user-name Eve --serial-number [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::123456789012:mfa/Eve

Barn:aws:iam::123456789012:mfa/Alice

Carn:aws:iam::123456789012:mfa/Bob

Darn:aws:iam::123456789012:mfa/Charlie

Attempts:

3 left

💡 Hint

Common Mistakes

Using a serial number for a different user

Omitting the serial number

The --serial-number must match the MFA device ARN for the user 'Eve'. Only option A matches the user.

4fill in blank

hard

Fill both blanks to attach an MFA policy to user 'Frank' and specify the policy ARN.

AWS

aws iam attach-user-policy --user-name [1] --policy-arn [2]

Drag options to blanks, or click blank then click option'

AFrank

Barn:aws:iam::aws:policy/IAMUserChangePassword

Carn:aws:iam::aws:policy/IAMUserMFADelete

Darn:aws:iam::aws:policy/IAMUserMFARequired

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong policy ARN

Misspelling the user name

The user name is 'Frank' and the policy ARN for requiring MFA is 'IAMUserMFARequired'.

5fill in blank

hard

Fill all three blanks to create an IAM policy JSON that requires MFA for all actions except listing S3 buckets.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [1],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": [2]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [3],
      "Resource": "*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

A"*"

B"false"

C["s3:ListAllMyBuckets"]

D"true"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' instead of 'false' for MFA condition

Allowing all actions without MFA

Incorrect action names

The Deny statement applies to all actions ("*") when MFA is not present ("false"). The Allow statement permits listing S3 buckets (["s3:ListAllMyBuckets"]).