Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A company is setting up its security guidelines for access management in AWS. The IT manager wants to enforce Multi-Factor Authentication (MFA) to protect the account's resources. According to AWS security best practices, which of the following identities should have MFA enabled? (Select TWO.)

  1. The AWS account root userAnswer
  2. Individual IAM users who perform administrative tasksAnswer
  3. C
    IAM roles assigned to Amazon EC2 instances
  4. D
    Security Groups applied to database instances
  5. E
    AWS Support personnel accessing physical data centers

Answer

The AWS account root user and individual IAM users who perform administrative tasks should have Multi-Factor Authentication (MFA) enabled.
The correct options are the AWS account root user and individual IAM users who perform administrative tasks. According to AWS security best practices, multi-factor authentication (MFA) should be enabled on the root account to prevent unauthorized access to the most privileged user in the account. Similarly, IAM users, particularly those with administrative privileges, should have MFA enabled to protect daily operational access.

Step-by-Step Solution

1
Identify the entities within the AWS environment that represent human users or credentials requiring protection via Multi-Factor Authentication (MFA).
MFA is applicable to user accounts that log in via the console or CLI, such as the root user and IAM users.
MFA adds an extra layer of security on top of user passwords to verify human identity.
2
Evaluate the non-human or machine-based entities and identify why they do not use MFA.
IAM roles use temporary security credentials and are assumed programmatically, while Security Groups are network firewalls, and physical security is managed by AWS.
These entities do not involve human interactive logins and thus do not support or require MFA configuration by the customer.

Key Concept

Multi-Factor Authentication (MFA) best practices for securing human identities in IAM.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic