SCS-C03 Identity and Access Management Practice Question
Which THREE actions are best practices for managing root user account security? (Select THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable multi-factor authentication (MFA) on the root account.
The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable multi-factor authentication (MFA) on the root account.
Why this is correct
MFA is the most critical defense against compromised root credentials. Without MFA, a leaked password grants full control over the AWS account. Requiring a hardware or virtual MFA device adds a necessary layer of protection, ensuring that even if the password is stolen, the attacker cannot access the account.
- ✗
Store the root access keys in a secure, encrypted S3 bucket.
Why it's wrong here
Root access keys should not exist. They should be deleted immediately after account creation. Storing them in an S3 bucket, even if encrypted, creates a single point of failure and potential target. The root user should only be accessed via the console using credentials and MFA, never via programmatic access keys.
- ✗
Use the root account for daily administrative tasks to simplify management.
Why it's wrong here
Using the root account for daily tasks is extremely dangerous. It violates the principle of least privilege and significantly increases the risk of accidental resource deletion or configuration changes. Administrative tasks should always be performed using an IAM user or role with the minimum necessary permissions required for the job.
- ✓
Delete the root access keys and do not create new ones.
Why this is correct
Access keys for the root account are unnecessary for day-to-day operations and present a major security risk. Deleting them ensures that there is no programmatic way to compromise the account using long-term credentials, forcing all administrative interaction to go through the console where MFA is required.
- ✓
Set up a strong password and rotate it at least once every 90 days.
Why this is correct
Even though root is rarely used, it must have a complex, unique password that is regularly rotated. This prevents brute-force attacks and limits the utility of a leaked password. Regular rotation, combined with MFA, ensures that the root account remains as secure as possible against unauthorized access attempts.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.