Which practice is a key foundational control for protecting the AWS account root user for a municipal account?
Select an answer to reveal the explanation.
Short Explanation
MFA on root is like needing both the key and the second token before the master lock turns — a simple, high-value protection. Wiki passwords, root access keys in apps, and blindfolding CloudTrail all make the master key easier to abuse.
Full Explanation
Enabling multi-factor authentication (MFA) on the root user is a key foundational control for protecting a municipal AWS account's master identity. MFA is like needing both the key and the second token before the master lock turns — simple and high value. Posting the root password on an internal wiki to speed break-glass access expands blast radius. Creating access keys for root and embedding them in every application turns a rare identity into a ubiquitous secret. Disabling CloudTrail so root activity cannot be reviewed removes detective controls precisely where they matter most. Distractors fail by publishing secrets, by proliferating root keys, or by blinding audit logs. Exam caveat: MFA on root is necessary but not sufficient; also avoid routine root use, prefer IAM for daily work, and monitor account-level changes. Operational check: verify root MFA is enabled with hardware or virtual MFA per policy, store recovery materials in dual-control escrow, ensure CloudTrail remains on, delete any root access keys if they exist, and test break-glass steps annually without leaving passwords on wikis. In practice, store root MFA recovery materials under dual control, test break-glass annually, and alert security the moment a root sign-in appears in CloudTrail.