ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Root user protection and break-glass access / Question 1

SCS-C03 practice question: Root user protection and break-glass access

Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A logistics group has 60 member accounts in one AWS organization. Many of the accounts were created years ago, and their root users still have passwords and MFA devices held by former staff. The security team wants to remove root credentials from every member account, and still be able to perform the few root-only tasks that sometimes arise.

The team does not want the management account root user used for routine work, and it does not want to share any root password.

Which solution meets these requirements?

Choose one answer.

  1. A. Create a shared password for the root user of each member account, store it in the company password vault, and limit vault access to the security team. Rotate the passwords every 90 days and log each retrieval.
  2. B. Create an access key for the root user of each member account, and store the keys in a secrets manager that automation can read. Delete the root password, so that the access keys become the only root credential.
  3. C. Turn on centralized root access management, delete the root credentials of the member accounts, and start a short-lived root session from the management account when a root-only task is needed.
  4. D. Enable MFA on the root user of each member account with a hardware key, and keep the root password in a sealed envelope in a safe. Ask the security team to check the safe every quarter.
Show the answer and explanation

Answer: C

  • A. Wrong: A shared root password keeps the full root power in every account, and the team forbids sharing root passwords. Rotation and vault logging do not remove the risk of an unknown holder.
  • B. Wrong: Root access keys give unlimited programmatic access, and they are long-term credentials that automation would expose. Deleting the password does not reduce the root user power, so this creates a larger risk.
  • C. Right: Correct. Removing member root credentials leaves no standing root access, and short-lived root sessions are issued only for approved tasks. The management account root user is not used for routine work. Learn more: Root user (opens in a new tab)
  • D. Wrong: MFA and a sealed password reduce misuse, but they keep standing root access in every account. The quarterly check is manual work, and the root credentials still exist in every account.

Explanation

Centralized root access management removes root credentials from member accounts, so no one holds standing root access there. Root-only tasks run through short, controlled sessions started from the management account. Shared passwords, root access keys, and MFA with a sealed password each keep standing root power.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Root user protection and break-glass accessAll Root user protection and break-glass access questions

Want more on Root user protection and break-glass access? The 5 full-length practice sets have 5 more Root user protection and break-glass access questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets