Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 13 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 13
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as follows:

Which combination of conditions must the security engineer add to the IAM policy to meet these requirements? (Choose two.)

A. "Bool": {"aws:MultiFactorAuthPresent": "true"}
B. "Bool": {"aws:MultiFactorAuthPresent": "false"}
C. "NumericLessThan": {"aws:MultiFactorAuthAge": "7200"}
D. "NumericGreaterThan": {"aws:MultiFactorAuthAge": "7200"}
E. "NumericLessThan": {"MaxSessionDuration": "7200"}

Show Suggested Answer

Suggested Answer: AC 🗳️

by kk2000 at Oct. 7, 2023, 10:57 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

kk2000

Highly Voted 1 year, 10 months ago

Correct Answer is AC

upvoted 8 times

...

molerowan

Most Recent 5 months, 2 weeks ago

Selected Answer: AC

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": "*", "Condition": { "Bool": {"aws:MultiFactorAuthPresent": "true"}, "NumericLessThan": {"aws:MultiFactorAuthAge": 7200} } } ] }

upvoted 1 times

...

youonebe

7 months, 2 weeks ago

Selected Answer: AC

AC, not AE. As mentioned in https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html

upvoted 1 times

...

102fe8d

9 months ago

its A & E MFAAge checks how much time has passed since the user's last MFA usage SessionAge makes sure the MFA session is NOT more than the selected timelimit.

upvoted 1 times

...

Gentlesoul

1 year ago

The correct answer is AC, the MFA age must be less than or equal to 7200

upvoted 1 times

...

nischal77777

1 year ago

Selected Answer: AC

Correct Answer is AC

upvoted 2 times

...

PareshBPatel

1 year, 6 months ago

C. "NumericLessThan": {"aws:MultiFactorAuthAge": "7200"} This condition ensures that the action is allowed only if the MFA session age is less than 7200 seconds (2 hours), meaning it enforces the requirement that each MFA session remains valid for only 2 hours. This is a correct choice as it directly addresses the session validity requirement. D. "NumericGreaterThan": {"aws:MultiFactorAuthAge": "7200"} This condition would allow the action only if the MFA session age is greater than 7200 seconds, which is contrary to the requirement. Therefore, this option is incorrect.

upvoted 2 times

...