SCS-C02 Question 437
Select 3Your company recently set up an AWS account, and as part of the security review, you need to ensure that the root account follows best practices. Which of the following actions should you take to secure the root account?
- A
Enable multi-factor authentication (MFA) for the root account.
- B
Delete the root access keys if they exist.
- C
Assign the root account to a specific IAM group with administrator permissions.
- D
Use the root account only for initial account setup or in emergencies.
- E
Share the root account credentials with trusted team members for quick access.
Show answer and explanation
Correct answers: A, B, D
Explanation
Following root account best practices is critical for securing your AWS environment. The root account has full access to all resources in the AWS account, and any compromise of this account could have severe consequences. By enabling MFA, deleting root access keys, and restricting the usage of the root account to only initial setup or emergencies, you significantly reduce the risk of unauthorized access and misuse.
- A. Correct.
Enabling MFA for the root account adds an extra layer of security by requiring a second factor (e.g., a code from a mobile device) in addition to the password.
- B. Correct.
Deleting root access keys, if they exist, is a best practice because root access keys can be misused and are not needed for day-to-day operations. Use IAM roles and users instead.
- C. Incorrect.
The root account cannot be assigned to IAM groups; IAM groups are for managing permissions of IAM users. This option is incorrect.
- D. Correct.
The root account should only be used for initial setup or emergencies to minimize potential exposure to risk. Day-to-day tasks should be performed using IAM users or roles.
- E. Incorrect.
Sharing root account credentials violates AWS best practices and can lead to security risks if credentials are compromised or misused. This option is incorrect.