A global manufacturer with 80 Organizations member accounts must eliminate standalone root passwords, enforce MFA on every root, and retain a tested emergency access path if Identity Center fails. The CISO requires centralized root credential governance and auditable break-glass use. Which root user management strategy meets these governance goals?
Select an answer to reveal the explanation.
Short Explanation
You’re guarding master keys without losing the spare. Centralized short-lived root access keeps control tight, like a bank vault with dual keys and drills.
Full Explanation
Centralized root access management allows privileged short-lived sessions for member root from the management account, combined with enforced MFA and tightly scoped, monitored break-glass procedures, which removes long-lived passwords while preserving auditable emergency access. Shared vault passwords with MFA only on management fails by concept because it retains long-lived credentials in members and leaves member roots without MFA. Deleting MFA and using email reset fails by concept because it weakens the highest-privilege identity and relies on insecure recovery. Using admin IAM users and ignoring root fails by concept because root remains ungoverned and can still be abused for account closure, billing changes, and password recovery. Exam caveat: centralize, enforce MFA everywhere, and test break-glass. Practical check: verify root credential and MFA status on the IAM root access management page and in credential reports, rotate break-glass secrets, and alert on root use.