Which two of the following options would allow an organization to enforce this policy for AWS users?

Explanations:

Enabling multi-factor authentication (MFA) for privileged IAM users strengthens security by requiring a second factor (something the user has) in addition to the password (something the user knows), which aligns with the policy requiring additional security layers.

Creating IAM users for privileged accounts does not necessarily enforce the use of frequently rotated passwords or one-time access credentials. This option alone doesn’t enforce the policy specified.

Implementing identity federation and leveraging the AWS IAM Security Token Service (STS) allows temporary credentials, which can be rotated frequently and used as one-time access credentials, fulfilling the policy’s requirement.

AWS does not provide a “single-use password policy option.” The password policy can enforce complexity and expiration, but it does not automatically enforce single-use passwords. Therefore, this option doesn’t directly meet the requirement.