SCS-C02 Question 438
Select 2Your organization has recently set up an AWS account for a new project. As the Security Lead, you are tasked with ensuring that the root account is secured according to best practices. Which of the following actions should you take to properly secure the root account? (Select TWO.)
- A
Enable multi-factor authentication (MFA) for the root account.
- B
Store the root account credentials in a shared document for emergency access.
- C
Delete the root account to prevent unauthorized access.
- D
Create an IAM user with administrator privileges and avoid using the root account for daily operations.
- E
Use the root account for deploying resources regularly to maintain full control.
Show answer and explanation
Correct answers: A, D
Explanation
Securing the root account is a fundamental AWS security best practice. The root account has unrestricted permissions in the AWS environment, making it critical to add MFA and use it only for tasks that cannot be performed by other IAM users. By creating an IAM user with administrator privileges, you can minimize the usage of the root account, reducing security risks.
- A. Correct.
Enabling MFA for the root account is a critical best practice to add an extra layer of security, ensuring that even if the password is compromised, unauthorized access is prevented.
- B. Incorrect.
Storing root account credentials in a shared document is highly insecure and violates AWS best practices, as it increases the risk of unauthorized access.
- C. Incorrect.
Deleting the root account is not possible in AWS. The root account is the primary account and cannot be removed.
- D. Correct.
Creating an IAM user with administrator privileges and avoiding the use of the root account for daily operations is a best practice to ensure the root account is only used for essential purposes, such as account setup or billing tasks.
- E. Incorrect.
Using the root account for regular operations is not recommended by AWS, as it increases the risk of accidental or unauthorized changes to critical account configurations.