Exam AWS Certified Security - Specialty topic 1 question 434 discussion

To resolve this issue, you or another administrator must delete the user's existing MFA device using the AWS CLI or AWS API. For more information, see I am not authorized to perform: iam:DeleteVirtualMFADevice. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html

Option D is not the correct answer because it would require the security engineer to sign in as the AWS account root user. This is not necessary in this case, as the security engineer can use the AWS CLI or AWS API to delete the virtual MFA device without signing in as the AWS account root user. The correct answer is C. The security engineer is not authorized to perform the iam:DeleteVirtualMFADevice action because the IAM role that they are using does not have the correct permissions. The IAM user has permissions to delete their own virtual MFA device, but only if they are authenticated with MFA. To resolve this issue, the security engineer can use the AWS CLI or AWS API to find the ARN of the virtual MFA device and to delete the device.

if the security engineer is receiving the error how will option C will work? I believe it is D

https://repost.aws/knowledge-center/lost-broken-mfa

The error message indicates that the security engineer is not authorized to perform iam:DeleteVirtualMFADevice, so modifying the policy for the IAM user to allow the IAM user to delete the virtual MFA device without using MFA authentication (option A) is not a recommended solution. Option B suggests signing in as the AWS account root user, which is not recommended because it violates the AWS security best practice of using the root user only for AWS account and billing management purposes. Option C is a viable solution, but it requires additional steps to find the ARN of the virtual MFA device and to ensure that the IAM user is authenticated with MFA. Therefore, the best solution is to sign in as the AWS account root user and delete the virtual MFA device using the IAM console (option D). The root user has the necessary permissions to delete the virtual MFA device, and the IAM console provides a user-friendly interface to manage IAM resources. Once the virtual MFA device is deleted, the IAM user can re-assign a new virtual MFA device.

C is correct https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa

it's C. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html