These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-014
What is the primary purpose of enabling MFA?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Strengthen authentication so that it does not rely on a password alone.
Explanation
MFA uses an additional factor such as an authenticator app in addition to a password, which lowers the risk of account takeover.
Per-choice explanations
A. Increase the storage capacity of Amazon S3.
Incorrect. It has nothing to do with S3 capacity.
B. Improve the CPU performance of Amazon EC2.
Incorrect. It has nothing to do with EC2 performance.
C. Invalidate the cache of Amazon CloudFront.
Incorrect. It has nothing to do with CloudFront cache invalidation.
D. Strengthen authentication so that it does not rely on a password alone.
Correct. MFA strengthens authentication.
Practical Use
Multi-Factor Authentication (MFA) is a mechanism that requires multiple factors of different types at sign-in. In addition to a password (a knowledge factor), it requires a one-time code generated by an authenticator app or a hardware security key (a possession factor). On AWS, MFA can be configured for both IAM users and the root user. With MFA enabled, an account cannot be taken over by a leaked password alone. Even if credentials are accidentally published to a public repository such as GitHub or stolen in a phishing attack, sign-in can be blocked as long as the second factor is not in the attacker's hands. This is the main purpose of enabling MFA. MFA devices used in practice include virtual MFA devices (smartphone apps such as Authy and Google Authenticator), U2F or FIDO2 security keys (physical devices such as YubiKey), and hardware TOTP devices. AWS official best practices recommend that MFA be enabled on highly privileged accounts, such as the root user, administrator IAM users, and CI/CD roles that have production deployment permissions. In addition, a standard design is to evaluate the MFA state using the IAM policy condition key aws:MultiFactorAuthPresent, and to allow sensitive operations only on sessions that passed MFA. On CLF-C02, this content is asked as a question about the primary purpose of enabling MFA, or about what can be done to lower the risk of account takeover. The correct answer is an option such as strengthening authentication so that it does not rely on a password alone. Common distractors apply unrelated service operations, such as increasing S3 capacity, improving EC2 performance, or invalidating the CloudFront cache.