Exams / CLF-C02 / Protecting the root user / Question 1
CLF-C02 practice question: Protecting the root user (1 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A security team wants to receive an alert whenever anyone signs in to the company's AWS account as the root user. Which approach follows AWS guidance?
Choose one answer.
- AA. A rule in Amazon EventBridge that matches root sign-in events and notifies through Amazon SNS
- BB. Download the AWS Artifact reports each week and search them for root user sign-ins
- CC. Enable Amazon Inspector so that it scans the account for any root user sign-ins
- DD. Delete the root user so that nobody can ever sign in with it again
Show the answer and explanation
Answer: A
- A. Right: Correct. AWS recommends monitoring root user activity with CloudWatch or EventBridge rules that notify through SNS.
- B. Wrong: AWS Artifact contains AWS's compliance documents, not sign-in activity for a customer's account.
- C. Wrong: Amazon Inspector scans workloads for software vulnerabilities. It does not monitor sign-in events.
- D. Wrong: An account's root user cannot be deleted like an IAM user. AWS's guidance is to protect it with MFA and monitor its use.
Explanation
Root user sign-ins are recorded by AWS CloudTrail. AWS's root user best practices recommend alerting on any root sign-in or use, for example with an EventBridge or CloudWatch rule that sends a notification through Amazon SNS, and having a documented response for these alerts. Root use should be rare, so any sign-in is worth checking.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.