Which combination of steps will enable multi-factor authentication (MFA) on an AWS account? (Select TWO.)

To enable multi-factor authentication (MFA), a user must first possess a compatible MFA device, which can be a hardware token or a virtual MFA application on a mobile device. After acquiring the device, the user must sign in to the AWS Management Console, navigate to the IAM service, and follow the steps to add and activate the new MFA device for their user account. This process can also be performed programmatically using the AWS Command Line Interface (CLI). This two-step process ensures enhanced security by requiring a second form of authentication.

A. Contacting AWS Support is not the standard procedure for enabling MFA; it is a self-service action performed by the user or administrator.
B. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service and is unrelated to user authentication or MFA.
D. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior; it does not manage MFA devices.

1. AWS Identity and Access Management User Guide. (2023). Using multi-factor authentication (MFA) in AWS. AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/idcredentialsmfa.html. The guide states, "To enable MFA for an IAM user, you need an MFA device that the user will use for authentication... After you have the device or have installed a virtual MFA app, you can enable and manage MFA devices in the IAM console, AWS Command Line Interface (AWS CLI), or AWS API."

2. AWS Identity and Access Management User Guide. (2023). Enabling a virtual MFA device (console). AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/idcredentialsmfaenablevirtual.html. This section details the steps within the IAM console, confirming it as the primary method.