Exam AWS Certified SysOps Administrator - Associate topic 1 question 228 discussion

C. none root users with proper IAM permissioncan change support plan. also non root users with admin access can also manage security aspect such as MFA settings. https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html

The Support Plan can be changed by any Administrator and not necessarily the Root account. Any Administrator could be used to simply Deactivate the affected MFA. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html#:~:text=To%20get%20help%20for%20an%20MFA%20device%20as%20an%20IAM%20user Root login should be avoided, but A is the only good option as 'B' talks about Re-Sync MFA instead of Deactivate it.

only Root user can configure MFA

Option A is the appropriate approach when the MFA device is lost for the root user. As a root user, the administrator can sign in using email and phone verification as a form of MFA. After signing in, they can set up a new MFA device to enhance security and change the root user password to further secure the account.

The SysOps administrator needs to sign in as the root user to change the AWS Support plan. Since the MFA device is lost, the administrator can sign in by using email and phone verification. After signing in, the administrator should set up a new MFA device and change the root user password for security reasons. It is generally recommended to use IAM users with limited permissions instead of root user accounts. However, in this case, since the support plan needs to be changed, the root user account is necessary.

A is correct. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html