CLF-C02 - Security and Compliance - Section 2.6

Understand how to protect the root user and apply authentication methods such as multi-factor authentication, AWS IAM Identity Center and federation, and where to store credentials securely.

Understand that the AWS account root user has unrestricted access and should be protected by enabling multi-factor authentication and avoiding its use for day-to-day tasks. Recognise IAM Identity Center for centralised single sign-on access across accounts, federation for connecting external identity providers, and AWS Secrets Manager for secure, audited storage of credentials and secrets.

Root user protectionMulti-factor authenticationIAM Identity CenterAWS Secrets Manager

Practice question for this objective

Free sampleSecurity and Compliancemedium

An organisation runs several AWS accounts and wants employees to sign in once to reach the accounts they are entitled to, and it also needs database passwords stored securely with automatic rotation. Which two AWS services together meet these needs? (Select TWO.)

  • AAWS IAM Identity Center to give employees one sign-in that reaches the accounts they are entitled to use. Correct
  • BAWS Secrets Manager to store the database passwords securely and rotate them automatically on a schedule. Correct
  • CAmazon CloudWatch to collect the database passwords centrally and present them to staff at each sign-in.
  • DAWS Config to record one sign-in for employees and to keep the database passwords rotated on a schedule.
  • EAWS CloudTrail to grant employees a single sign-on and to hold the database passwords for the application.
IAM Identity Center delivers single sign-on across accounts, while Secrets Manager stores and automatically rotates credentials such as database passwords. These two needs map to two purpose-built services: IAM Identity Center centralises workforce sign-in so one identity reaches many accounts, and Secrets Manager keeps credentials encrypted and rotates them on a schedule, whereas monitoring, configuration, and audit services solve unrelated problems.

Why A is correct: IAM Identity Center provides centralised single sign-on across multiple accounts from one set of credentials.

Why B is correct: Secrets Manager safeguards credentials such as database passwords and can rotate them automatically without code changes.

Why C is wrong: CloudWatch monitors metrics and logs, but it neither stores secret credentials nor handles employee sign-in.

Why D is wrong: Config tracks resource configuration history, but it does not provide single sign-on or manage secret rotation.

Why E is wrong: CloudTrail records account API activity for audit, but it offers no sign-on portal and stores no credentials.

See more CLF-C02 practice questions, answers explained.

More in this domain

Back to all Security and Compliance objectives, or the CLF-C02 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.