These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-036
Which of the following is the most appropriate first security measure to apply to the root user of an AWS account?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: B. Enable MFA for the root user
Explanation
The root user has strong permissions over the entire AWS account. Enabling MFA and avoiding day-to-day use are essential practices.
Per-choice explanations
A. Create multiple access keys for the root user
Incorrect. The basic guidance is not to create root user access keys, or to delete them if they exist.
B. Enable MFA for the root user
Correct. MFA must always be configured for the root user.
C. Grant AdministratorAccess to all IAM users
Incorrect. Granting AdministratorAccess to everyone violates the principle of least privilege.
D. Use the root user for day-to-day development work
Incorrect. The root user should not be used for day-to-day work.
Practical Use
The root user of an AWS account is the top-level privileged identity, signed in with the email address and password used at account creation, and has unrestricted access to every AWS service and resource. If the root user is compromised, the account billing information can be changed, all resources can be deleted, and large numbers of unauthorized resources can be launched, so its protection has the highest priority. The AWS best practice is to always enable MFA on the root user, avoid using it for day-to-day operations, and instead work with an IAM user or a user provisioned through IAM Identity Center. On the exam, the typical question asks which configuration should be applied first to strengthen AWS account security, and the correct answer is to enable MFA for the root user. Distractors include creating multiple access keys for the root user, using the root user for day-to-day development work, and granting AdministratorAccess to all IAM users. All of these are the opposite of the principle of least privilege and root user protection guidance, and can be ruled out if you understand the best practices. In practice, the recommended initial configuration immediately after opening an account typically consists of enabling MFA on the root user, avoiding the creation of root user access keys, creating an administrator IAM user or an IAM Identity Center user, setting up a budget alert with AWS Budgets, and enabling AWS CloudTrail to record API activity. CLF-C02 frequently asks about this initial configuration immediately after account creation, and the three keywords of the root user vs. IAM user division of roles, MFA, and the principle of least privilege come up repeatedly.