Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company is conducting a security audit of its AWS infrastructure. The audit reveals that the IT team uses the AWS account root user for daily configuration tasks, and several application servers use embedded long-term AWS access keys to write data to Amazon S3. Which of the following actions should the company take to align with AWS Identity and Access Management (IAM) security best practices? (Select TWO.)

  1. Enable multi-factor authentication (MFA) on the AWS account root user and create individual IAM users for daily administrative tasks.Answer
  2. Configure the application servers to use IAM roles with temporary credentials instead of long-term access keys.Answer
  3. C
    Create a single shared IAM Admin user for all IT administrators to simplify credentials rotation and auditing.
  4. D
    Share the AWS account root user credentials with the administrative team to ensure uninterrupted access during emergencies.
  5. E
    Submit a ticket to AWS Support to request that they manage and rotate the access keys for the application servers.

Answer

Enable multi-factor authentication (MFA) on the AWS account root user and create individual IAM users for daily administrative tasks, and configure the application servers to use IAM roles with temporary credentials instead of long-term access keys.
The correct actions are securing the root user with multi-factor authentication (MFA) while using individual IAM users for daily administrative activities, and configuring application servers to use IAM roles with temporary credentials rather than long-term access keys. These actions adhere to the principle of least privilege, guarantee auditability, and minimize the risk of compromised long-term credentials.

Step-by-Step Solution

1
Analyze the security risk of using the AWS account root user for daily configuration tasks.
The root user possesses unrestricted privileges that cannot be locked down. Continued operational use increases the attack surface.
AWS security standards state that the root user should be secured with MFA and restricted to a tiny subset of account-level administrative actions.
2
Address the risk of hardcoded long-term credentials on application servers.
Long-term access keys are permanent until rotated manually, presenting a leak risk if credentials are checked into repositories or compromised.
AWS recommends replacing static credentials with IAM roles, which leverage short-term, temporary security credentials that rotate automatically.
3
Evaluate and discard insecure administrative models.
Shared credentials (like shared IAM users or shared root accounts) break audit trails, and requesting AWS to manage client keys violates the Shared Responsibility Model.
Every administrator must have a unique identity, and the customer retains operational control over IAM configuration.

Key Concept

Applying core IAM security principles including root account protection, temporary credentials via IAM roles, and distinct administrative identities.
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic