SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use the root user regularly for administrative tasks.

  Why it's wrong here

  Using the root user for routine administrative tasks contradicts AWS's least-privilege model: the root user is not constrained by any IAM policy, so every session is an all-powerful blast radius if credentials are exposed. Best practice is to lock down root and instead operate daily through IAM roles or users with narrowly scoped permissions, reserving root only for specific account-owner actions.

• ✗

  Create an access key for the root user for programmatic access.

  Why it's wrong here

  Root user access keys cannot be restricted by IAM policies—they are effectively a second, non-rotating administrative credential that grants full API access to every service in the account. Unlike IAM roles, these keys also cannot be tied to a rotation schedule or condition keys, making them a standing risk. AWS explicitly discourages creating root access keys; if they are ever created, they should be deleted.

• ✗

  Grant other IAM users full administrator access.

  Why it's wrong here

  Replacing root-user logins with IAM users is generally encouraged, but granting those users full administrator access is not a protection for the root account itself: it merely shifts the privileged identity to somewhere else, and full AdministratorAccess violates least privilege. The root user's security remains solely dependent on its own password, MFA, and absence of access keys. Thus this option is an indirect and overly broad IAM strategy rather than a valid root-protection measure.

• ✓

  Use a strong, complex password for the root user.

  Why this is correct

  A strong, complex password for the root user is a core, direct defensive control because the root account bypasses all IAM policies, so the console password is the only baseline barrier against unauthorized sign-ins. A long mix of characters, coupled with the absence of the password being reused elsewhere, materially reduces the risk of credential-stuffing and forced-entry attacks. AWS recommends a minimum of 14 characters for the root password.

• ✓

  Enable multi-factor authentication (MFA) for the root user.

  Why this is correct

  Enabling multi-factor authentication (MFA) on the root user adds a second authentication requirement, so knowledge of the password alone is insufficient to access the account. Because root has irrevocable permissions over billing, IAM, and every service, MFA is the single highest-impact control to mitigate password theft or leakage. AWS explicitly mandates MFA for root in its best-practice documentation.

Go deeper

Related to this question