These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-011
Which of the following is the most appropriate recommendation for the root user of an AWS account?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. Avoid using it for day-to-day work and enable MFA.
Explanation
The root user has full permissions over the account. The recommended practice is to avoid day-to-day use, enable MFA, and not create access keys.
Per-choice explanations
A. Prevent anyone from viewing the billing information.
Incorrect. Reviewing billing information is important to prevent unexpected charges.
B. Create access keys and store them on GitHub.
Incorrect. Storing access keys on GitHub is dangerous.
C. Avoid using it for day-to-day work and enable MFA.
Correct. Protect the root user and do not use it for day-to-day work.
D. Share the password among all developers.
Incorrect. Sharing passwords should be avoided.
Practical Use
The root user of an AWS account is the top-level privileged identity with full permissions over the account, including account closure, payment method changes, and Support plan changes. Because the permissions are so broad, day-to-day use is not recommended. AWS best practices state that the root user should be used only for a limited set of tasks (for example, IAM user creation right after sign-up, Support plan changes, and specific billing settings). For everyday work, use an IAM user or a user provisioned through IAM Identity Center. Protective measures such as enabling MFA, setting a strong password, and not creating access keys (or deleting them if they already exist) are also considered mandatory. In practice, a standard pattern is to create an administrator IAM user (or an IAM Identity Center user) immediately after the initial setup is complete, and to perform all subsequent work as that IAM user. When you use AWS Organizations, the root user of a member account cannot be fully restricted even with a Service Control Policy (SCP). For that reason, enable MFA on the root user of every account and manage the credentials strictly using a vault or a password manager. There have been real incidents where root user access keys were accidentally published to a public GitHub repository and a third party took over the account and launched expensive resources. Not creating access keys in the first place is the most reliable defense. On CLF-C02, this content typically appears as a question that asks which of the following is the correct recommendation for the root user. The correct answer is the option that strengthens protection and limits use, such as avoiding day-to-day work and enabling MFA. Typical distractors clearly contradict security best practices, such as creating access keys and storing them on GitHub, sharing the password among all developers, or preventing anyone from viewing billing information.