SAA-C03 Q648 · Security

Question

A company uses AWS to run its ecommerce platform. The platform is critical to the company's operations and has a high volume of traffic and transactions. The company configures a multi-factor authentication (MFA) device to secure its AWS account root user credentials. The company wants to ensure that it will not lose access to the root user account if the MFA device is lost. Which solution will meet these requirements?

Accepted Answer

**Option B: Add multiple MFA devices for the root user account.**

Since November 2022, AWS supports registering **up to 8 MFA devices** per IAM user, including the root user. This directly addresses the disaster scenario:

1. **Requirement: Don't lose access to root if MFA device is lost** → Having multiple MFA devices means if one is lost/broken, the root user can still authenticate with another registered device.
2. **Root user access is irreplaceable** → Certain AWS actions can ONLY be performed by the root user (e.g., closing the account, changing the account name, restoring IAM permissions, enabling S3 MFA delete). No administrator IAM user can substitute for root.
3. **Proactive vs. Reactive** → This is a proactive measure taken BEFORE the disaster occurs, ensuring continuous access

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

⚙️ Operations

🔒 Security

🎯 Exam Tips