Your organization’s security policy requires that all privileged users either use frequently rotated passwords or
one-time access credentials in addition to username/password.
Which two of the following options would allow an organization to enforce this policy for AWS users?
Choose 2 answers
A.
Configure multi-factor authentication for privileged 1AM users
B.
Create 1AM users for privileged accounts
C.
Implement identity federation between your organization’s Identity provider leveraging the 1AM Security
Token Service
D.
Enable the 1AM single-use password policy option for privileged users
I would go for A and B
See also: http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
Enable MFA for privileged users
For extra security, enable multifactor authentication (MFA) for privileged IAM users (users who are allowed access to sensitive resources or APIs). With MFA, users have a device that generates a unique authentication code (a one-time password, or OTP) and users must provide both their normal credentials (like their user name and password) and the OTP. The MFA device can either be a special piece of hardware, or it can be a virtual device (for example, it can run in an app on a smartphone).
Thx, F
0
0
I don’t agree with B – there is no such thing as “privileged account”, account can have privileged users but by itself it’s just an account.
0
0
Agree with Frank – A & B
0
0
Nice find Frank! A and B.
0
0
Option A already mentions there is a privileged user why choose B?
Configure multi-factor authentication for “privileged IAM users”
0
0
Agree with A but not sure about B vs. C. Simply creating an IAM user doesn’t solve the issue. IAM users need a correctly configured password policy. Likewise if you choose to federate to an external / non-AWS entity such as AD, you can hope that similar policies would be enforced there but there is no guarantee that they will be. So, not sure at all between B and C.
0
0
I like A and D because the question is asking about “use frequently rotated passwords or one-time access credentials ”
1- You can apply a password policy to your AWS account to require all your IAM users to rotate their passwords for frequently rotated password ( Answer is D )
2-Use MFA for one time password ( Answer is A )
0
0
I think A & D will be right but most of the site have A & B.
0
0
A & D
B – Even if you create an IAM user, it does not talk about frequently rotated passwords
C – Even if you federate, you do not know anything about password rotation policy
0
0
A & C
B – wrong, no rotated password
D – AWS no single-use policy option, you have to write the policy yourself, so the answer is wrong.
A – one time access creds
C – password rotation by group policy (windows AD) or other way.
0
0
The only problem with D is such option doesn’t exist in IAM Password Policy.
Correct answers are A and B.
0
0
The correct answer is:
C) Implement identity federation between your organization’s Identity provider leveraging the 1AM Security Token Service
D) Enable the 1AM single-use password policy option for privileged users
0
0
ab
0
0
For me, A – D
A: one time access
D: rotate password life time
0
0
ab is the right ans
0
0
The trick is —OR— : “that all privileged users either use frequently rotated passwords OR one-time access credentials in addition to username/password.”
MFA and accounts for privileged users (A and B) are correct.
The “single-use” policy not exists. You can create a policy password to expire password from 1 to 1065 days…
0
0
AB are correct.
0
0
AB
0
0
AC
A for obvious reason
B Users are already present so wrong
C STS is kind of 1 time access, because next time it will again authenticate
D No such service in IAM so wrong
0
0
A & B
0
0
Question is not clear:
you need both at the same time? Then A and B.
0
0
A and B – First you have to define/create privileged users, and also have MFA policy for them
0
0
A.
Configure multi-factor authentication for privileged IAM users
B.
Create IAM users for privileged accounts
0
0