A Company Has an IAM Group

A company has an IAM group. All of the IAM users in the group have been assigned a multi-factor authentication (MFA) device and have full access to Amazon S3. The company needs to ensure that users in the group can perform S3 actions only after the users authenticate with MFA. A security engineer must design a solution that accomplishes this goal with the least maintenance overhead. Which combination of actions will meet these requirements? (Choose two.)

A) Add a customer managed Deny policy to users in the group for s3:*actions.
B) Add a customer managed Deny policy to the group for s3:*actions.
C) Add a customer managed Allow policy to the group for s3:*actions.
D) Add a condition to the policy: "Condition" : { "BoolIfExists" : { "aws:MultiFactorAuthPresent" : false } }
E) "Condition" : { "Bool" : { "aws:MultiFactorAuthPresent" : false } }