How to Protect the AWS Root User with Highest Security
A company wants to ensure that their AWS account root user is protected with the highest level of security. Which two actions should they take? (Choose the answer that covers both.)
Quick Answer
The correct answer involves enabling multi-factor authentication (MFA) and deleting any existing root access keys, as these two actions provide the highest level of security for the AWS root user. This is because the root user has unrestricted, irreversible access to all AWS resources and billing data, so MFA adds a critical second layer of protection beyond the password, while removing access keys eliminates the risk of long-term programmatic credentials that could be compromised. On the AWS Certified Cloud Practitioner CLF-C02 exam, this concept tests your understanding of the shared responsibility model and the principle of least privilege, often appearing in a scenario where a company must secure the root user without sharing credentials. A common trap is thinking that sharing the root password with a team is acceptable—AWS explicitly advises against this, as it violates security best practices. Remember the mnemonic "MFA and no keys" to recall the two essential actions for root user protection.
⚠ Common exam trap
Many candidates think both Option B and Option C are correct because they are both marked with [CORRECT] in the question, but sharing the root password is not a security best practice. Only enabling MFA on the root account and deleting root access keys (Option B) is the correct action. Option C is a common mistake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MFA on the root account and delete any existing root access keys
To protect the AWS account root user with the highest level of security, you should enable MFA on the root account and delete any existing root access keys (Option B). This prevents unauthorized access using stolen credentials and eliminates the risk of long-term programmatic access. Sharing the root password (Option C) is a security anti-pattern because it increases the attack surface and violates the principle of least privilege. Instead, use IAM roles and users for day-to-day operations. Therefore, only Option B is a recommended best practice. Note that the question asks for two actions, but based on the options provided, only Option B is correct; Option C is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create IAM user access keys for the root account to enable programmatic access
Why it's wrong here
Creating IAM user access keys for the root account is not a best practice because root access keys cannot be managed or rotated like IAM user keys and pose an unacceptable security risk.
- ✓
Enable MFA on the root account and delete any existing root access keys
Why this is correct
Enabling MFA on the root account and deleting any existing root access keys is the correct action to protect the root user with the highest level of security.
- ✗
Share the root password with the security team for emergency access
Why it's wrong here
Sharing the root password with the security team for emergency access is a security anti-pattern; it increases the attack surface and violates the principle of least privilege.
- ✗
Use the root account for all day-to-day AWS operations to avoid delegation complexity
Why it's wrong here
Using the root account for all day-to-day AWS operations is not recommended; instead, use IAM roles and users with appropriate permissions.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is setting up their AWS account for the first time. What security action should they take immediately after creating the account?
easy- A.Create IAM users for all employees immediately
- ✓ B.Enable MFA on the root account and create an IAM admin user for daily operations
- C.Create root access keys for programmatic access
- D.Enable AWS Config in all regions
Why B: The root user has unrestricted access to the AWS account, and enabling Multi-Factor Authentication (MFA) on the root account adds a critical second layer of security to prevent unauthorized access. Creating an IAM admin user for daily operations follows the principle of least privilege, ensuring that routine administrative tasks are performed using IAM roles or users with controlled permissions, rather than the highly privileged root user. This is a foundational security best practice recommended by AWS immediately after account creation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.