A city security policy requires MFA for every human console session, including break-glass access. Which recommendation aligns with AWS MFA best practices?
Select an answer to reveal the explanation.
Short Explanation
MFA is the second lock on every console door—including the emergency one. Root and IAM humans who open the Management Console should need that second factor; access keys alone are not MFA for console sessions. Skipping MFA on root “just in case” is the opposite of break-glass hygiene.
Full Explanation
AWS recommends multi-factor authentication for human console access, including the root user and privileged IAM users. Access keys authenticate API calls and are not a substitute for MFA on interactive console sessions. Leaving root without MFA or removing console authentication entirely weakens the city’s required control for human access, including break-glass paths that still need strong identity assurance.