AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 58
After enabling S3 MFA-Delete, for which actions do you need MFA? (Select two)
-
A
Listing deleted versions
-
B
Enabling Versioning
-
C
Suspending versioning
-
D
Permanently delete an object version
-
E
Uploading a new object version
Reveal correct answers
Correct answers: C, D
Explanation
Correct options:
Permanently delete an object version
Suspending versioning
You may add another layer of security by configuring a bucket to enable MFA (multi-factor authentication) Delete, which requires additional authentication for either of the following operations:
Change the versioning state of your bucket
Permanently delete an object version
MFA Delete requires two forms of authentication together:
Your security credentials
The concatenation of a valid serial number, a space, and the six-digit code displayed on an approved authentication device
If a bucket's versioning configuration is MFA Delete–enabled, the bucket owner must include the x-amz-mfa request header in requests to permanently delete an object version or change the versioning state of the bucket. Requests that include x-amz-mfa must use HTTPS.
Incorrect options:
Enabling Versioning - You do not need MFA to enable versioning for a bucket.
Listing deleted versions - You do not need MFA to list deleted versions.
Uploading a new object version - You do not need MFA to upload a new object version.
References:
https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
