SAA-C03 Q480 · IAM

Question

A company has established a new AWS account. The account is newly provisioned and no changes have been made to the default settings. The company is concerned about the security of the AWS account root user. What should be done to secure the root user?

Accepted Answer

**Answer B** is correct because it addresses both critical aspects of root user security:

1. **Create IAM users for daily administrative tasks**: The root user has unrestricted access to everything in the AWS account. By creating IAM users with appropriate permissions, you follow the **principle of least privilege** and avoid using the root user for routine operations. This limits exposure of root credentials.

2. **Enable multi-factor authentication (MFA) on the root user**: Since the root user **cannot be deleted or disabled**, the best protection is to add MFA. This means even if someone obtains the root user's email and password, they still cannot sign in without the physical MFA device or virtual authenticator. MFA adds a critical second layer of defense.

This answer directly aligns

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

⚙️ Operations

🔒 Security

🎯 Exam Tips