SCS-C02 Threat Detection and Incident Response Practice Question

Which TWO actions are best practices for securing an AWS account's root user? (Choose 2.)

⚠ Common exam trap

Many candidates think sharing the root password with the team (Option A) is a valid emergency access strategy, but AWS explicitly recommends using IAM roles with a break-glass process (e.g., AWS Systems Manager Incident Manager) instead, as shared passwords create auditability and credential rotation issues.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a strong password and store it securely

Option B is correct because the root user has unrestricted access to all AWS resources and billing, so it must be protected with a strong, complex password stored in a secure location such as a password manager or secrets vault. Option C is correct because enabling MFA on the root user adds a critical second authentication factor, ensuring that a compromised password alone cannot grant full account control. Options A, D, and E are not best practices: sharing the root password violates least privilege and accountability, using root for daily administrative tasks should be avoided in favor of IAM users or roles, and creating root access keys is discouraged because long-lived root credentials cannot be scoped down and pose a severe security risk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Share the root user password with the team for emergency access
Why it's wrong here
Sharing the root password removes individual accountability and makes credential rotation and revocation impossible, directly undermining root protection. It is tempting because emergency break-glass access is a genuine requirement, but that is met with a secured, monitored credential vault rather than shared knowledge.
✓
Use a strong password and store it securely
Why this is correct
A strong, uniquely complex root password stored securely reduces the risk of credential compromise, since the root user cannot be restricted by IAM policies and has unrestricted account access. This satisfies the best-practise requirement for protecting that identity.
✓
Enable multi-factor authentication (MFA) on the root user
Why this is correct
Enabling MFA on the root user adds a second authentication factor beyond the password, so a leaked or guessed credential alone cannot grant full account control. This directly satisfies the stem's requirement to secure the highly privileged root user, which cannot be restricted by IAM policies.
✗
Use the root user for daily administrative tasks
Why it's wrong here
Daily administrative work should use federated IAM identities or roles, not root, which bypasses permission boundaries and cannot be restricted. It is tempting because root holds full permissions, so it appears convenient, but root is reserved for the few tasks only it can perform.
✗
Create access keys for the root user for programmatic access
Why it's wrong here
Root user access keys grant unrestricted programmatic access that cannot be scoped by policy, so creating them widens exposure rather than securing the account. It is tempting because access keys are the normal mechanism for programmatic access, and would be correct for an IAM user or role, never root.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question