Learn how to add an extra layer of security when authenticating IAM users in your AWS account by enabling multi-factor authentication (MFA). Follow AWS security best practices to protect your cloud resources.
Table of Contents
Question
You want an added layer of security to authenticate a user when the user logs in. What should you do?
A. Delete the IAM user’s access keys
B. Use Amazon inspector
C. Place the IAM user in a specific IAM group
D. Enable multi-factor authentication (MFA) on the IAM user’s account
Answer
D. Enable multi-factor authentication (MFA) on the IAM user’s account
Explanation
Enable MFA on the IAM user’s account so that the user needs two credentials to login.
Placing the user in a group can help with authorizing a user’s access, but not with authenticating the user. Amazon inspector does not help with authenticating users. Deleting a users keys is also not a solution.
To add an extra layer of security when authenticating a user at login, the best option is to enable multi-factor authentication (MFA) on the IAM user’s account.
MFA requires the user to provide an additional form of authentication beyond just their username and password. This is typically a temporary one-time password (TOTP) generated by a hardware device or mobile app. With MFA enabled, even if an attacker obtains the user’s password, they still can’t log in without also providing the TOTP code.
AWS supports virtual and hardware MFA devices for IAM users. It’s a security best practice to require MFA for all users, especially those with elevated permissions. MFA provides strong protection against common threats like phishing attacks and credential theft.
The other options are not the most effective for adding an extra authentication factor:
- Deleting access keys prevents programmatic access but doesn’t impact console login
- Amazon Inspector assesses applications for vulnerabilities but doesn’t provide authentication
- Placing the user in a specific IAM group helps manage permissions but doesn’t strengthen authentication
So in summary, enabling MFA is the recommended solution for requiring an additional verification step beyond a password when users log into your AWS account. It’s an essential security control for any organization running workloads on AWS.
Getting Started with Security EDSECUv1EN-US assessment question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the Getting Started with Security EDSECUv1EN-US assessment and earn Getting Started with Security EDSECUv1EN-US badge.