Exam Bundle

Longer password only: Improves a password characteristic but does not add a distinct authentication factor. This does not address the need for An administrator wants another verification factor beyond password for sensitive console access. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

Security group ingress rule: Controls specified inbound network access, not identity authentication. This does not address the need for An administrator wants another verification factor beyond password for sensitive console access. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

S3 versioning: Retains object versions rather than establishing a second factor of authentication. This does not address the need for An administrator wants another verification factor beyond password for sensitive console access. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

Longer password only: Improves a password characteristic but does not add a distinct authentication factor. That does not meet the requirement: An account owner enables an additional authentication step to reduce stolen-password risk.

S3 versioning: Retains object versions rather than establishing a second factor of authentication. That does not meet the requirement: An account owner enables an additional authentication step to reduce stolen-password risk.

Security group ingress rule: Controls specified inbound network access, not identity authentication. That does not meet the requirement: An account owner enables an additional authentication step to reduce stolen-password risk.

Longer password only: Improves a password characteristic but does not add a distinct authentication factor. This does not address the need for An account owner enables an additional authentication step to reduce stolen-password risk. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

S3 versioning: Retains object versions rather than establishing a second factor of authentication. This does not address the need for An account owner enables an additional authentication step to reduce stolen-password risk. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

Security group ingress rule: Controls specified inbound network access, not identity authentication. This does not address the need for An account owner enables an additional authentication step to reduce stolen-password risk. The appropriate Multi-factor authentication applies because MFA adds an independent factor and reduces risk from a compromised password.

Disable audit logging: Removes a trail of security or operational actions that should remain attributable. That does not meet the requirement: Consider this AWS requirement: A newly created AWS account needs a secure root account used only for exceptional tasks.

Use root for all deployments: Exposes the highest-privilege account identity during routine automation. That does not meet the requirement: Consider this AWS requirement: A newly created AWS account needs a secure root account used only for exceptional tasks.

Share root credentials: Gives highly privileged identity credentials to others and reduces accountability. That does not meet the requirement: Consider this AWS requirement: A newly created AWS account needs a secure root account used only for exceptional tasks.

Disable audit logging: Removes a trail of security or operational actions that should remain attributable. This does not address the need for A newly created AWS account needs a secure root account used only for exceptional tasks. The appropriate Restrict root use and enable MFA applies because Root has highly privileged powers and should be protected by MFA and avoided for routine activities.

Share root credentials: Gives highly privileged identity credentials to others and reduces accountability. This does not address the need for A newly created AWS account needs a secure root account used only for exceptional tasks. The appropriate Restrict root use and enable MFA applies because Root has highly privileged powers and should be protected by MFA and avoided for routine activities.

Use root for all deployments: Exposes the highest-privilege account identity during routine automation. This does not address the need for A newly created AWS account needs a secure root account used only for exceptional tasks. The appropriate Restrict root use and enable MFA applies because Root has highly privileged powers and should be protected by MFA and avoided for routine activities.

Share root credentials: Gives highly privileged identity credentials to others and reduces accountability. That does not meet the requirement: A security audit flags frequent use of the root account for everyday development work.

Use root for all deployments: Exposes the highest-privilege account identity during routine automation. That does not meet the requirement: A security audit flags frequent use of the root account for everyday development work.

Disable audit logging: Removes a trail of security or operational actions that should remain attributable. That does not meet the requirement: A security audit flags frequent use of the root account for everyday development work.

Share root credentials: Gives highly privileged identity credentials to others and reduces accountability. This does not address the need for A security audit flags frequent use of the root account for everyday development work. The appropriate Restrict root use and enable MFA applies because Root has highly privileged powers and should be protected by MFA and avoided for routine activities.

Use root for all deployments: Exposes the highest-privilege account identity during routine automation. This does not address the need for A security audit flags frequent use of the root account for everyday development work. The appropriate Restrict root use and enable MFA applies because Root has highly privileged powers and should be protected by MFA and avoided for routine activities.

Disable audit logging: Removes a trail of security or operational actions that should remain attributable. This does not address the need for A security audit flags frequent use of the root account for everyday development work. The appropriate Restrict root use and enable MFA applies because Root has highly privileged powers and should be protected by MFA and avoided for routine activities.

Ordinary IAM user is a routine account identity and does not perform root-user-only account administration. That does not meet the requirement: A technical reviewer evaluates this need: For a standalone AWS account using traditional root credentials, the owner needs to update the root sign-in password.

S3 bucket policy: Defines resource-level permissions for an S3 bucket. That does not meet the requirement: A technical reviewer evaluates this need: For a standalone AWS account using traditional root credentials, the owner needs to update the root sign-in password.

EC2 instance role grants compute permissions but cannot substitute for root-only account-level identity actions. That does not meet the requirement: A technical reviewer evaluates this need: For a standalone AWS account using traditional root credentials, the owner needs to update the root sign-in password.

S3 bucket policy: Defines resource-level permissions for an S3 bucket. This does not address the need for For a standalone AWS account using traditional root credentials, the owner needs to update the root sign-in password. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

EC2 instance role grants compute permissions but cannot substitute for root-only account-level identity actions. This does not address the need for For a standalone AWS account using traditional root credentials, the owner needs to update the root sign-in password. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

Ordinary IAM user is a routine account identity and does not perform root-user-only account administration. This does not address the need for For a standalone AWS account using traditional root credentials, the owner needs to update the root sign-in password. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

S3 bucket policy: Defines resource-level permissions for an S3 bucket. That does not meet the requirement: An owner of an eligible AWS account must change the existing root user password through account settings.

EC2 instance role grants compute permissions but cannot substitute for root-only account-level identity actions. That does not meet the requirement: An owner of an eligible AWS account must change the existing root user password through account settings.

Ordinary IAM user is a routine account identity and does not perform root-user-only account administration. That does not meet the requirement: An owner of an eligible AWS account must change the existing root user password through account settings.

S3 bucket policy: Defines resource-level permissions for an S3 bucket. This does not address the need for An owner of an eligible AWS account must change the existing root user password through account settings. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

Ordinary IAM user is a routine account identity and does not perform root-user-only account administration. This does not address the need for An owner of an eligible AWS account must change the existing root user password through account settings. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.

EC2 instance role grants compute permissions but cannot substitute for root-only account-level identity actions. This does not address the need for An owner of an eligible AWS account must change the existing root user password through account settings. The appropriate Account root user applies because Updating the root user password requires root authentication for eligible standalone accounts; ordinary IAM users or roles cannot do it.