ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Protecting the root user / Question 1

CLF-C02 practice question: Protecting the root user (1 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A security team wants to be notified within minutes whenever anyone signs in to the company's management account as the root user.

The team already uses Amazon SNS for alerts.

Which approach follows AWS guidance?

Choose one answer.

  1. A. An EventBridge rule that matches root user activity and notifies through Amazon SNS
  2. B. A check of the CloudTrail event history at the start of each month for root sign-ins
  3. C. Turn on Amazon Inspector, which scans the account for root user sign-ins
  4. D. A weekly download of AWS Artifact reports, searched for root user sign-ins
Show the answer and explanation

Answer: A

  • A. Right: Correct. AWS recommends using EventBridge with SNS to write a rule that tracks root user usage and sends a notification. The alert is sent as the root activity is recorded, so the team can check it straight away. Learn more: Root user best practices for your AWS account (opens in a new tab)
  • B. Wrong: A monthly check would find root sign-ins weeks after they happen. Event history is useful for review, but it does not alert the team when a sign-in occurs.
  • C. Wrong: Amazon Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities. It does not monitor sign-in events.
  • D. Wrong: AWS Artifact provides AWS's compliance reports and agreements. It does not record sign-in activity for a customer's account.

Explanation

Root user activity is recorded in AWS CloudTrail. AWS recommends alerting on root user sign-in and use, for example with an EventBridge rule that notifies the team through an SNS topic. The other options either check far too late, or describe services that do not monitor sign-ins.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Protecting the root userAll Protecting the root user questions

Want more on Protecting the root user? The 5 full-length practice sets have 10 more Protecting the root user questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets