SAA-C03 Q341 · IAM

Question

A company is implementing a new policy to enhance the security of its AWS environment. The policy requires all administrative actions that users perform on the AWS Management Console to be secured by multi-factor authentication (MFA). Which solution will allow the company to enforce this policy in the MOST operationally efficient way?

Accepted Answer

**Option B: Create an IAM policy that requires MFA for IAM roles that administrators assume.**

This is correct because:

1. **Requirement: Enforce MFA on all administrative console actions** — An IAM policy with an `aws:MultiFactorAuthPresent` condition key can explicitly deny or restrict actions unless MFA is authenticated. When attached to IAM roles that administrators assume, it ensures no administrative action can proceed without MFA.

2. **Operationally efficient** — This is a declarative, preventive control. Once the policy is in place, enforcement is automatic. No manual monitoring, no reactive remediation, no ongoing operational overhead.

3. **How it works technically:**
   - Administrators assume an IAM role to perform admin tasks.
   - The role's trust policy or permission poli

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips