AWS Certified SysOps Administrator – Associate — Question 150

A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However, users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA.

What additional step must be taken to ensure that API calls are authenticated using MFA?

Answer options

• A. Enable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.
• B. Ask the IAM users to log into the AWS Management Console with MFA before making API calls using the CLI.
• C. Restrict the IAM users to use of the console, as MFA is not supported for CLI use.
• D. Require users to use temporary credentials from the get-session token command to sign API calls.

Correct answer: D

Explanation

The correct answer is D because using temporary credentials from the get-session-token command allows users to include the MFA token in their API calls, ensuring they are authenticated properly. Option A does not enforce MFA on API calls made directly by users, B only applies to console access and not CLI, and C incorrectly suggests that CLI use cannot support MFA.