Exam AWS Certified SysOps Administrator - Associate topic 1 question 234 discussion

D. Require users to use temporary credentials from the get-session token command to sign API calls. In order to enforce MFA for API calls using the CLI, the company needs to require users to use temporary credentials obtained from the get-session-token command. This command will prompt the user to enter their MFA token, and will return temporary security credentials that include an MFA token. The user can then use these temporary credentials to sign API calls, which will ensure that the calls are authenticated using MFA. The temporary credentials will automatically expire after a set duration, ensuring that access is limited and secure.

D only

Using the temporary security credentials that the call returns, IAM users can then make programmatic calls to API operations that require MFA authentication. An incorrect MFA code causes the API to return an access denied erro

Concur with D and I'll reference this document - https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html

See my other response for justification for "D". I still wonder a little about "A". Not my field of expertise here, but I do know they do know they sometimes change syntax subtly to create a trick question.

I hope answer is "D" and this isn't a trick question. The actual API/CLI calls are GetSessionToken and "get-session-token", NOT "get-session" token (no 2nd dash) Real world examples: https://sts.amazonaws.com/?Version=2011-06-15&Action=GetSessionToken&... aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-token...

The most appropriate step to ensure that API calls are authenticated using MFA is to require users to use temporary credentials from the get-session token command to sign API calls. This is because the get-session token command returns temporary security credentials consisting of an access key ID, a secret access key, and a session token that are valid only for a limited period of time. These credentials can be used to make API calls with MFA authentication.

Answer D: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html