ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Reusing the existing on-premises Active Directory and its Active Directory Federation Services (ADFS) keeps user identities in one place and lets administrators revoke access centrally through normal account management processes. By adding an MFA requirement in ADFS-such as an OATH-compliant phone application like Microsoft Authenticator-employees receive a second authentication factor without issuing physical tokens. AD Connector simply passes the credentials through to AD, so no additional AWS account management is needed. Creating separate IAM users with virtual MFA or separate Amazon Cognito identities would duplicate credentials and raise operational effort, while asking users to enter a second password provides no true second factor and remains single-factor authentication.