SCS-C02 Question 436
Select 3Your company has just created a new AWS account for a critical production workload. As part of the initial security setup, what are the best practices for securing the root account?
- A
Enable multi-factor authentication (MFA) for the root account.
- B
Delete the root account access keys if they are not required.
- C
Use the root account for daily administrative tasks.
- D
Create an IAM user with administrative privileges and use it for account management.
- E
Share the root account credentials securely with team members for emergency access.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing the root account is critical to maintaining the security of your AWS environment. Best practices include enabling MFA, deleting unnecessary root access keys, and minimizing root account usage. Instead of using the root account, create IAM users or roles with appropriate permissions for daily administrative tasks. Sharing root account credentials is highly discouraged as it introduces significant security risks.
- A. Correct.
This is correct. Enabling MFA for the root account adds an extra layer of security, making it harder for unauthorized users to access the account.
- B. Correct.
This is correct. Root access keys are highly sensitive and should be deleted if they are not needed to reduce the risk of compromise.
- C. Incorrect.
This is incorrect. The root account should not be used for daily tasks; instead, IAM users or roles should be used for administrative activities.
- D. Correct.
This is correct. Creating an IAM user with administrative privileges and using it instead of the root account is a best practice for security and reducing risk.
- E. Incorrect.
This is incorrect. Root account credentials should never be shared, even securely, as it violates security best practices. Emergency access should be managed through IAM users or roles with appropriate permissions.