Exams / CLF-C02 / Protecting the root user / Question 2
CLF-C02 practice question: Protecting the root user (2 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
Which task can be performed ONLY by signing in as the root user of a standalone AWS account that is not part of AWS Organizations?
Choose one answer.
- AA. Creating an IAM user with administrator permissions
- BB. Closing the AWS account
- CC. Launching Amazon EC2 instances in a new Region
- DD. Changing the account name and alternate contacts
Show the answer and explanation
Answer: B
- A. Wrong: An IAM user or role with the right permissions can create IAM users. This does not need the root user.
- B. Right: Correct. Closing a standalone account is one of the tasks that require root user credentials.
- C. Wrong: Any IAM identity with EC2 permissions can launch instances in any enabled Region.
- D. Wrong: AWS lists account name and alternate contacts among settings that do not require root user credentials.
Explanation
Only a small number of tasks require the root user, such as closing a standalone account, changing the root user's email address or password, restoring IAM permissions when the only administrator has locked themselves out, and some billing tasks. Everything else should be done with IAM identities, which is why the root user should be protected and used rarely.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.