ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Authentication and federation / Question 1

CLF-C02 practice question: Authentication and federation (1 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A company is registering multi-factor authentication (MFA) for the root user of its management account.

It wants two devices, so that one can cover for the other.

Which TWO of these are MFA types that AWS supports for the root user? (Choose two.)

Choose two answers.

  1. A. A FIDO certified hardware security key from a third-party provider
  2. B. A virtual authenticator app that runs on a phone or other device
  3. C. A one-time code sent to the account's phone by SMS text message
  4. D. A security question that only the administrator can answer
  5. E. A strong password of at least 20 characters that includes a symbol
Show the answer and explanation

Answers: A, B

  • A. Right: Correct. AWS supports FIDO certified hardware security keys as an MFA type for the root user. Learn more: Available MFA types for a root user (opens in a new tab)
  • B. Right: Correct. A virtual authenticator app emulates a physical MFA device. AWS lists it among the supported MFA types for the root user.
  • C. Wrong: SMS is not one of the MFA types AWS lists for the root user, so this device cannot be registered for root.
  • D. Wrong: A security question is something the user knows. It is not a second factor, and it is not an MFA type AWS supports for the root user.
  • E. Wrong: A password is a single factor, and a stronger password does not add MFA. AWS requires a separate MFA device for the root user.

Explanation

AWS supports three MFA types for the root user: FIDO certified hardware security keys, hardware TOTP tokens, and virtual authenticator apps. The root user can have up to eight MFA devices, and AWS recommends registering more than one. SMS, security questions and passwords are not among the MFA types AWS supports for the root user.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Authentication and federationAll Authentication and federation questions

Want more on Authentication and federation? The 5 full-length practice sets have 10 more Authentication and federation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets