Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

To secure a newly created AWS account, an administrator needs to establish basic identity and access controls. According to AWS security best practices, which of the following actions should the administrator perform? (Select TWO.)

  1. Enable Multi-Factor Authentication (MFA) on the AWS account root userAnswer
  2. Create individual IAM users for administrators to perform daily tasksAnswer
  3. C
    Share the root user access keys with the development team to simplify deployment workflows
  4. D
    Use the AWS account root user credentials to run routine automated backup scripts
  5. E
    Hardcode permanent IAM user access keys within applications running on EC2 instances to access other AWS services

Answer

Enable Multi-Factor Authentication (MFA) on the AWS account root user, and create individual IAM users for administrators to perform daily tasks.
Securing the AWS account root user using multi-factor authentication (MFA) is a primary security recommendation. Additionally, administrators should create individual IAM users for daily administrative and operational work rather than using the root user, ensuring that actions can be audited and limited in scope.

Step-by-Step Solution

1
Identify the recommended practices for securing the root user account.
The root user has unrestricted access to all resources and must be secured immediately by enabling Multi-Factor Authentication (MFA) and locking away its credentials.
This prevents unauthorized access to the entire AWS account.
2
Determine the appropriate configuration for administrative and routine tasks.
Instead of using the root user, administrators must create individual IAM users with appropriate permissions for daily activities.
This establishes individual accountability and aligns with the principle of least privilege.

Key Concept

AWS account security best practices dictate that the root user should not be used for daily tasks, must be protected with MFA, and daily tasks should be performed by individual IAM identities with minimal required privileges.
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic