CLF-C02 Question 110
Select 3Which of the following tasks can only be performed by the AWS account root user?
- A
Changing the account's root user password
- B
Deleting an AWS account
- C
Creating IAM users
- D
Enabling multi-factor authentication (MFA) for the root user
- E
Closing a specific EC2 instance
Show answer and explanation
Correct answers: A, B, D
Explanation
The AWS account root user is the most privileged account in AWS and is required for tasks that involve managing the account itself, such as changing the root password, deleting the account, or enabling MFA for the root user. These tasks are highly sensitive and cannot be delegated to IAM users or roles, unlike other operational tasks such as managing individual resources.
- A. Correct.
Only the root user can change the root user's password as it directly pertains to the account's highest level of access.
- B. Correct.
Only the root user has the necessary permissions to delete or close the AWS account, as it is a sensitive and irreversible action.
- C. Incorrect.
Creating IAM users can be done by any IAM user with sufficient permissions, not just the root user.
- D. Correct.
Enabling MFA for the root user must be done by the root user because it pertains to securing the account's primary credentials.
- E. Incorrect.
Closing or terminating individual EC2 instances can be performed by IAM users or roles with the appropriate permissions, not just the root user.