An enterprise manages 120 AWS accounts in Organizations and must prevent routine root use, enforce phishing-resistant MFA for any root access, and allow emergency access within one hour with full auditability. Which root credential strategy should the security team implement to manage AWS account root user credentials?

The correct strategy works because centralized root credential management via Organizations removes standing member root passwords and access keys, which prevents routine root use at scale across 120 accounts while still allowing time-bound privileged sessions from the management account that enforce phishing-resistant MFA such as FIDO2 and generate CloudTrail records for full auditability and sub-hour emergency access. The vault-based approach using virtual MFA fails on authentication strength because TOTP authenticator apps are not phishing-resistant and do not meet the mandated FIDO2 or passkey bar despite offering central storage, rapid checkout and logging. The centrally managed approach requiring a two-week CAB approval fails on recovery timeliness because extended change governance cannot satisfy the one-hour emergency access objective even though it provides strong MFA and audit trails. The approach retaining active root access keys for automation fails on least privilege and root-use prevention because persistent long-term root keys create routine use and enlarge blast radius instead of deleting keys and using short-lived role-based access. An exam caveat is that any answer mentioning email recovery, SMS or virtual MFA should be treated as insufficient when the stem explicitly demands phishing-resistant MFA, even if the rest of the design looks mature. As a practical check, verify in the console that member root credentials show centrally managed status with no active passwords or keys, test a supervised FIDO2 root session from the management account, and confirm CloudTrail shows the privileged session event end to end before declaring the control operational.