AWS Certified DevOps Engineer – Professional — Question 131

A company has an organization in AWS Organizations. The company has configured AWS Single Sign-On (AWS SSO) to centrally manage access to the AWS accounts in the organization. A DevOps engineer needs to ensure that all users sign in by using multi-factor authentication (MFA). Users must be allowed to manage their own MFA devices. Users also must be prompted for MFA every time they sign in.

What should the DevOps engineer do to meet these requirements?

Answer options

• A. In AWS SSO, configure always-on MFBlock user sign-in when a user does not yet have a registered MFA device.
• B. In AWS SSO, configure always-on MFA. Require a user to register an MFA device at sign-in when the user does not yet have a registered MFA device.
• C. In AWS SSO, configure context-aware MFA. Update the trust policy of all permission sets to include the aws:MultiFactorAuthPresent condition on the sts:AssumeRole action.
• D. In AWS SSO, configure context-aware MFA. Block user sign-in when a user does not yet have a registered MFA device.

Correct answer: B

Explanation

The correct answer is B because it ensures that MFA is always required and users are prompted to register an MFA device during sign-in if they haven't already. Option A does not require MFA registration at sign-in, while options C and D involve context-aware MFA, which is not necessary for the stated requirements.