CLF-C02 Practice Question 4: Root User Protection

AWS recommends safeguarding root user credentials, enabling multi-factor authentication on the root user, and using it only for the few tasks that require it. Everyday work should be done with IAM identities (ideally federated human users with temporary credentials) granted only the permissions they need.

Option B is the opposite of safeguarding a credential that has unrestricted access to every resource and every bill in the account. Option C is explicitly discouraged: AWS recommends not creating root user access keys at all, and applications should use IAM roles that supply temporary credentials instead. Option D does not work; the root user cannot be restricted by an IAM permissions policy, since it always retains full access to the account; guardrails such as service control policies in AWS Organizations are the mechanism for limiting member account root users.

Reference: Root user best practices for your AWS account