CLF-C02 - Security and Compliance (30% of the exam) - Section 2.6

Understand how to protect the root user and apply authentication methods such as multi-factor authentication, AWS IAM Identity Center and federation, and where to store credentials securely.

Understand that the AWS account root user has unrestricted access and should be protected by enabling multi-factor authentication and avoiding its use for day-to-day tasks. Recognise IAM Identity Center for centralised single sign-on access across accounts, federation for connecting external identity providers, and AWS Secrets Manager for secure, audited storage of credentials and secrets.

Root user protectionMulti-factor authenticationIAM Identity CenterAWS Secrets Manager

Practice question for this objective

Free sampleSecurity and Compliancemedium

An organisation runs several AWS accounts and wants employees to sign in once to reach the accounts they are entitled to, and it also needs database passwords stored securely with automatic rotation. Which two AWS services together meet these needs? (Select TWO.)

AAWS IAM Identity Center to give employees one sign-in that reaches the accounts they are entitled to use. Correct
BAWS Secrets Manager to store the database passwords securely and rotate them automatically on a schedule. Correct
CAmazon CloudWatch to collect the database passwords centrally and present them to staff at each sign-in.
DAWS Config to record one sign-in for employees and to keep the database passwords rotated on a schedule.
EAWS CloudTrail to grant employees a single sign-on and to hold the database passwords for the application.

IAM Identity Center delivers single sign-on across accounts, while Secrets Manager stores and automatically rotates credentials such as database passwords. These two needs map to two purpose-built services: IAM Identity Center centralises workforce sign-in so one identity reaches many accounts, and Secrets Manager keeps credentials encrypted and rotates them on a schedule, whereas monitoring, configuration, and audit services solve unrelated problems.

Why A is correct: IAM Identity Center provides centralised single sign-on across multiple accounts from one set of credentials.

Why B is correct: Secrets Manager safeguards credentials such as database passwords and can rotate them automatically without code changes.

Why C is wrong: CloudWatch monitors metrics and logs, but it neither stores secret credentials nor handles employee sign-in.

Why D is wrong: Config tracks resource configuration history, but it does not provide single sign-on or manage secret rotation.

Why E is wrong: CloudTrail records account API activity for audit, but it offers no sign-on portal and stores no credentials.

See more CLF-C02 practice questions, answers explained.

Exam traps in Security and Compliance

Answers that look right on this material and are not. Each one is a distractor from a different question in the CLF-C02 bank for this domain.

Share the root user password with every administrator so the team can respond to incidents quickly
Why it is wrong: Sharing the root password spreads an unrestricted credential across many people, which removes accountability and greatly increases the risk of misuse rather than reducing it.
Amazon Cognito, which adds sign-up and sign-in features for the end users of a customer-facing app
Why it is wrong: Amazon Cognito handles identity for an application's external customers, so it is tempting but solves a different problem than workforce access to AWS accounts.
Use the root user for all everyday administrative tasks so its activity is easy to track
Why it is wrong: Using the root user daily increases exposure of its powerful credentials, so AWS recommends the opposite and reserves the root user for the few tasks that require it.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.