Root user quiz · Level 0 · Todo.io Learns AWS

Question 1Todo.io wants to stop anyone, including the root user, from deleting the audit bucket in its Prod account. Prod is a member account. Can an SCP do that?

Yes. SCPs apply to the root user of a member account too.Correct. IAM policies can't limit root, but an SCP can, in member accounts.No. The root user ignores every policy.Not this one. Root ignores IAM policies, not SCPs. In a member account, an SCP Deny stops root too.Only if the root user has MFA turned on.Not this one. MFA protects how root signs in. It doesn't change what an SCP allows.Only if Prod is the management account.Not this one. The opposite: SCPs never apply to the management account.

Learn it: SCP (service control policy) · Root user

Question 2Todo.io's founder signs in as the root user every day to manage everything. Which change best follows AWS security best practice?

Turn on MFA for the root user, stop using it day to day, and sign in through IAM Identity Center with only the access the job needs.Correct. The root user can do almost anything and only an SCP can limit it. Protect it with MFA and keep it for the few jobs that need it.Create access keys for the root user, so the founder can use the CLI instead of the console.Not this one. Root access keys are the most dangerous credentials in an account. AWS recommends never creating them.Share the root password with a second person as a backup.Not this one. Shared passwords hide who did what, and double the chances of a leak. Give each person their own sign-in.Rename the root user so attackers cannot guess it.Not this one. The root user can't be renamed. It's signed in with the account's email address.

Learn it: Root user · Set up AWS: Day 0

Question 3What does "Root user" mean?

The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.Correct. Think of it as: The master key to the whole building.A container for AWS resources, with its own identities and its own bill.Not this one. That describes AWS account.A second proof of identity, like a code from an app or a security key, on top of a password.Not this one. That describes MFA (multi-factor authentication).Groups many AWS accounts under one management account, with one bill and shared guardrails.Not this one. That describes AWS Organizations.

Learn it: Root user

Question 4Which term is this? "The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it."

Root userCorrect. Yes. Think of it as: The master key to the whole building.AWS accountNot this one. AWS account is: A container for AWS resources, with its own identities and its own bill.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails.

Learn it: Root user

Question 5Which AWS term is described by this analogy? "The master key to the whole building."

Root userCorrect. Yes: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.AWS accountNot this one. AWS account is: A container for AWS resources, with its own identities and its own bill. Its analogy: A flat in an apartment building. Separate locks, separate meter.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password. Its analogy: A PIN on top of the key card.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails. Its analogy: The building management company that owns every flat.

Learn it: Root user

Root user

Worth another look

Your weak spots

Services

Concepts