Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 179 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 179
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A.

A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort.

Which solution should the security engineer recommend?

A. Add an aws:MultiFactorAuthPresent condition to the role's permissions policy.
B. Add an aws MultiFactorAuthPresent condition to the role’s trust policy.
C. Add an aws:MultiFactorAuthPresent condition to the session policy.
D. Add an aws:MultiFactorAuthPresent condition to the S3 bucket policies.

Show Suggested Answer

Suggested Answer: B 🗳️

by mikelord at Oct. 3, 2024, 1:46 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

rinip86277

3 days, 1 hour ago

Selected Answer: B

I go with B

upvoted 1 times

...

TareDHakim

5 months, 1 week ago

Selected Answer: B

ChatGPT Explanation: The trust policy determines who can assume the IAM role. Adding an aws:MultiFactorAuthPresent condition to the trust policy ensures that only sessions authenticated with MFA can assume the role.

upvoted 2 times

...

723993f

6 months, 3 weeks ago

Selected Answer: B

I think about Trust policy as a "Resource Policy" for IAM role, just as a matter of understanding and remembering, not how AWS wants us to think about it so just like any other resource where we add a resource policy (if available) when you want to protect the resource, you do the same for iam role

upvoted 2 times

...

mikelord

8 months, 2 weeks ago

Option B is the correct answer because adding the aws:MultiFactorAuthPresent condition to the role's trust policy enforces MFA for role assumption, ensuring that only users who have authenticated with MFA can assume the role. This solution meets the requirement effectively and with minimal changes.

upvoted 3 times

...