A company wants to enforce strict security controls on its AWS environment. They want to ensure that all IAM users are required to use Multi-Factor Authentication (MFA) before they can access any AWS services via the CLI or Management Console. Which TWO actions should a solutions architect take to meet this requirement? (Select TWO.)

Create an IAM policy that denies all actions except IAM MFA management if the aws:MultiFactorAuthPresent condition is false.

Enable the 'Require MFA' setting in the AWS account settings.

Use AWS Config to automatically delete IAM users who do not have MFA enabled.

Attach the MFA enforcement IAM policy to an IAM group and place all users in that group.

Create a Service Control Policy (SCP) that requires MFA for all API calls.