Question 690
Which high-level AWS choice is most appropriate for this business requirement? A shared administrator password is known by several employees and management wants a second authentication factor.
Explanation
Correct Answer
Require MFA for applicable privileged identities and replace shared credentials with individual identities. This is the best high-level recommendation for the stated situation. Multifactor authentication adds a factor beyond a password to strengthen sign-in security. The key business clue is: Look for account takeover risk from compromised passwords. A suitable choice is: Require MFA for applicable privileged identities and replace shared credentials with individual identities. An expected result is: A stolen password alone is insufficient for the protected sign-in flow. Important limitation: MFA lowers risk but does not eliminate phishing and compromised-session attacks.
Incorrect Answers
The AWS account root user should be protected and avoided for routine administrative work. That addresses a different mechanism; this question turns on Require MFA for applicable privileged identities and replace shared.
Temporary role credentials are preferable to embedded long-lived keys for many workloads. In the present case the governing issue is Require MFA for applicable privileged identities and replace shared, which this does not resolve.
AWS IAM Identity Center provides centralized workforce access and single sign-on capabilities. It does not verify the requested outcome; here the decisive check concerns Require MFA for applicable privileged identities and replace shared.