CLF-C02 Question 113
Select 2Which of the following actions can help protect the AWS root user account from unauthorized access? (Choose TWO)
- A
Enable multi-factor authentication (MFA) for the root user account.
- B
Delete the root user account after creating an IAM user with admin permissions.
- C
Use a strong, unique password for the root user account.
- D
Create an IAM role with full administrator access and attach it to the root user account.
- E
Securely store root user credentials and only use them for essential tasks.
Show answer and explanation
Correct answers: A, C
Explanation
Protecting the root user account in AWS is critical as it has unrestricted access to all AWS resources. Enabling multi-factor authentication (MFA) and using a strong, unique password are both effective methods to secure the root account. These measures help ensure that unauthorized users cannot easily gain access, even if the password is compromised. Other options, such as deleting the root account or attaching IAM roles to it, are either not possible or not relevant to root user protection.
- A. Correct.
Enabling multi-factor authentication (MFA) for the root user account adds an extra layer of security, making it more difficult for unauthorized users to gain access.
- B. Incorrect.
The root user account cannot be deleted in AWS. It is the foundational account for accessing AWS resources, so this option is incorrect.
- C. Correct.
Using a strong, unique password for the root user account is a fundamental security measure to prevent unauthorized access.
- D. Incorrect.
IAM roles cannot be attached to the root user account. Roles are designed to provide temporary access permissions to users, applications, or services, not the root user.
- E. Incorrect.
While securely storing root credentials and limiting their use is a good practice, it is not a direct method to protect the account from unauthorized access.