What's the FIRST security action AWS recommends for a brand-new account's root user?
A.Create access keys for the root user
Root access keys are a major risk — AWS recommends deleting them.
B.Enable multi-factor authentication (MFA) on the root user, then stop using root for daily work
Correct. MFA on root is the first recommended step.
C.Share root credentials with the admin team
Sharing root credentials defeats accountability entirely.
D.Use root for all daily administration
Root should be locked away for rare tasks, not daily use.
Why this answer
AWS's standing guidance: secure the root user with MFA immediately, create IAM identities for daily work, and reserve root for the few tasks that require it (billing changes, account closure).
Correct answer: B · Last reviewed 2026-10-28
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics