Which statement correctly describes root-user responsibilities at Cloud Practitioner depth for a city AWS account?
Select an answer to reveal the explanation.
Short Explanation
Root is the master key to the whole account — you keep it locked away and only bring it out for rare account-level jobs like closing the account or certain account settings. Day-to-day work should use IAM users or roles, not root.
Full Explanation
Only the root user can perform certain account-level tasks such as changing some account settings or closing the account — that is the correct Cloud Practitioner framing of root responsibilities for a city AWS account. Root is the master key kept locked away for rare account-level jobs. The root user should not run every daily EC2 start and stop job. IAM users can be created without first enabling root access keys. Root is not required to attach every security group rule in every VPC; IAM principals with permissions can manage network controls. Distractors fail by making root the daily operator, by inventing a root-access-key prerequisite for IAM, or by requiring root for routine security group edits. Exam caveat: because some account settings remain root-only, protecting root with MFA and avoiding root access keys is mandatory hygiene, not optional. Operational check: document which tasks truly need root, keep an MFA-backed break-glass procedure, perform daily EC2 operations with IAM roles, verify no root access keys exist, and audit root login events whenever they occur. In practice, publish a one-page root-use policy listing the few account-level tasks, keep IAM for everything else, and monitor that root remains idle between break-glass drills.