DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a strong, complex password and change it every 90 days.

  Why it's wrong here

  While a strong, complex password rotated every 90 days is a baseline security hygiene measure, it does not mitigate the most common credential theft vectors such as phishing or keylogging. The password remains a single authentication factor; if an attacker captures it, they can directly sign in to the AWS Management Console as the root user. AWS's own guidance emphasizes that MFA is the critical control for root accounts, as it requires a second factor that an attacker is unlikely to possess, making password rotation alone insufficient to protect the account.

• ✗

  Use the root user for everyday administrative tasks.

  Why it's wrong here

  The root user has unrestricted access to every resource, including billing, IAM, and all AWS services, with no ability to scope permissions or apply conditions. Using the root user for everyday administrative tasks violates the principle of least privilege and dramatically increases the blast radius if credentials are compromised. AWS explicitly documents that the root user should be used only for a limited set of account management tasks, such as closing the account or changing support plans, and that IAM users or roles with scoped permissions should be used for routine administration to enable fine-grained auditability and control.

• ✓

  Enable multi-factor authentication (MFA) on the root user.

  Why this is correct

  Enabling multi-factor authentication (MFA) on the root user is a foundational AWS Well-Architected security control because it adds a second authentication factor, typically a hardware token or virtual device, that an attacker cannot easily replicate. Even if the root password is stolen through phishing, keylogging, or a data breach, MFA prevents unauthorized sign-in without the physical or virtual device. AWS documentation lists root user MFA as a mandatory security recommendation, and it is one of the only two effective protective actions among the presented options — the other being the removal of root access keys — because it directly defeats password-only compromise.

• ✗

  Rotate the root user password every 30 days.

  Why it's wrong here

  Rotating the root user password every 30 days does not address the core vulnerability: the root account remains protected by a single knowledge-based factor. An attacker who obtains the current password during a rotation window can still log in and may even change the password or disable MFA if not already enabled. Moreover, root user password rotation does nothing to protect against API-based access using long-term access keys, which bypass the console login entirely. AWS's security model requires MFA as the primary safeguard, not frequent password rotation, making this action ineffective as a standalone protective measure.

• ✓

  Delete or disable the root user access keys.

  Why this is correct

  Deleting or disabling root user access keys is essential because these long-term static credentials provide direct programmatic access to the entire AWS account with no permissions boundaries or role-based restrictions. Unlike IAM user credentials, root access keys cannot be scoped, and AWS recommends that they either never be created or be removed immediately if they exist. By eliminating root access keys, you close the most dangerous API-level privilege escalation path, because an attacker who obtains those keys can assume full control over all resources without needing the password or MFA. This action, alongside enabling MFA, constitutes one of the two effective protections for a root account, as confirmed by AWS security best practices.

Go deeper

Related to this question