Which statement correctly describes the second factors that can be registered for an IAM user in AWS?
Show answer and explanation
Answer: B
IAM accepts several MFA forms: virtual authenticator apps that produce time-based one-time passwords, FIDO security keys that complete a WebAuthn challenge, and physical hardware devices that generate time-based codes. An account can standardise on one form or allow several, and privileged identities such as the root user should always have at least one registered.
SMS is at best a fallback that AWS discourages because of SIM-swap and interception risk, and it is not the only option; restricting MFA to a single factor type is also inaccurate.
Why the other options are wrong
- A. Virtual authenticator apps are supported, but they are not the only option. FIDO security keys and hardware code-generating tokens can be registered as well.
- C. SMS is not the only supported factor, and it is specifically the weakest one: phone numbers can be hijacked through SIM swapping, so AWS recommends stronger factors for privileged users.
- D. FIDO2 keys are supported and phishing-resistant, but they are not mandatory or exclusive. Hardware TOTP tokens and virtual authenticator apps remain valid choices.
Exam tip. Root and other privileged identities should use a phishing-resistant FIDO key; never leave the root account on a single weak factor.