DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Do not create access keys for the root user; use IAM users instead

  Why this is correct

  Root access keys are long-lived and carry unrestricted permissions that cannot be scoped down by any IAM policy. If they are leaked, the entire account is compromised, and because AWS does not allow you to restrict root credentials, the keys remain an unmanageable risk. Instead, create IAM users with only the necessary permissions, and use temporary credentials from AWS STS (roles) for programmatic access, so each request is authenticated with least privilege and can be audited.

• ✗

  Delete the root user after creating administrative IAM users

  Why it's wrong here

  The root user is the account owner entity itself; it cannot be deleted or removed from the account, only closed with the entire AWS account. Even after you create fully privileged administrative IAM users, the root user still exists and is the ultimate fallback for account management, billing, and service limit changes. Trying to 'delete' it is not a supported or valid security control; you must instead secure the root user's credentials and limit its use.

• ✓

  Enable multi-factor authentication (MFA) on the root user

  Why this is correct

  Enabling MFA on the root user ensures that even if the root user's password is stolen or guessed, an attacker must also possess the physical MFA device to sign in. Since root user actions are exempt from all IAM permission restrictions, MFA is the single most important safeguard for that identity. AWS recommends MFA on root and requires it for certain sensitive operations such as permanently deleting the account, adding virtual MFA, or closing the account.

• ✗

  Rotate the root user password every 30 days

  Why it's wrong here

  Rotating the root password every 30 days does nothing to mitigate the primary threat vectors: leaked access keys or compromised MFA/credentials used for API calls. Password rotation is only a minor control for the console sign-in path, and root passwords are not generally a high-risk exposure compared to programmatic keys. AWS best practice is to avoid using the root user's password altogether by using IAM users with their own passwords, MFA, and least-privilege policies, rendering periodic rotation largely irrelevant.

• ✗

  Change the root user's email address to a group email

  Why it's wrong here

  Changing the root user's email to a distribution list or shared group mailbox reduces accountability and expands the number of people with knowledge of the account's recovery channel. AWS sends sensitive security notifications, password reset links, and account alerts to that email address, so a shared recipient can intercept or mishandle those messages. Best practice is to keep a single, actively monitored, individually-owned email address as the root contact, and to enforce MFA and strong passwords on it.

Go deeper

Related to this question