Task 6.1: Develop a Strategy to Centrally Deploy and Manage AWS Accounts SCS-C03 Practice Questions (Page 8)

Questions 36–36

1. 36application · medium

   A company's security policy requires that all AWS account root users have multi-factor authentication (MFA) enabled. The company has over 50 member accounts in AWS Organizations. The security team wants to enforce this requirement centrally and ensure that if a root user's MFA device is lost, there is a documented process to regain access. What should the team do?

   • ACreate a new IAM user in each member account with administrative permissions and disable the root user.
   • BStore the root user credentials and MFA device for each account in a central password manager accessible to the security team.
   • CUse AWS Control Tower to automatically enable MFA on all root user accounts.
   • DCreate an SCP that denies all root user actions unless MFA is present, and document a break-glass procedure for root user access that involves contacting AWS Support.
   Reveal Solution Discussion Select an answer first