Practice exam-style questions. Ask the moment you get stuck.

Question Analysis

Core Concept: This question tests AWS account root user security best practices. The root user is the account owner identity with unrestricted permissions. AWS recommends minimizing root usage, protecting it with MFA, and using IAM identities (or IAM Identity Center) for day-to-day administration. Why the Answer is Correct: In AWS, you cannot “disable” the root user. Therefore, the best-practice approach is to (1) create IAM users/roles for daily administrative tasks and (2) enable MFA on the root user to reduce the risk of credential compromise. Option B matches both requirements: it moves routine work to least-privilege IAM identities and hardens the root account with MFA. Key AWS Features / Best Practices: - Enable MFA on the root user (virtual or hardware MFA/FIDO2 where supported). This is a foundational control and is explicitly called out in AWS security guidance and the AWS Well-Architected Framework (Security pillar: protect identities). - Do not create root access keys; remove any that exist. Root access keys are high-risk because they enable long-lived programmatic access with unlimited privileges. - Use IAM users/roles (or IAM Identity Center with federation) for daily admin tasks, ideally with least privilege and temporary credentials (STS) where possible. - Store root credentials securely (e.g., password manager), restrict who can access them, and use root only for tasks that require it (e.g., changing account settings, closing the account, some billing and support actions). Common Misconceptions: Option A sounds plausible because “disable root” is a common pattern in other systems, but AWS does not allow disabling the root user. Options C and D reflect unsafe practices: using root for daily work or sharing root credentials increases blast radius and audit gaps. Exam Tips: When you see “secure the root user,” the expected actions are: enable MFA on root, avoid using root for daily tasks, and never use/create root access keys. Also remember: root cannot be disabled or restricted by IAM policies, so compensating controls (MFA + minimal use) are key.