Root User MFA Backup Strategy for AWS

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Add multiple MFA devices for the root user account to handle the disaster scenario.

Question

A company uses AWS to run its ecommerce platform. The platform is critical to the company's operations and has a high volume of traffic and transactions. The company configures a multi-factor authentication (MFA) device to secure its AWS account root user credentials. The company wants to ensure that it will not lose access to the root user account if the MFA device is lost. Which solution will meet these requirements?
  1. Set up a backup administrator account that the company can use to log in if the company loses the MFA device.
  2. Add multiple MFA devices for the root user account to handle the disaster scenario. Correct Answer
  3. Create a new administrator account when the company cannot access the root account.
  4. Attach the administrator policy to another IAM user when the company cannot access the root account.

Key Takeaways

The exam tests knowledge of IAM MFA capabilities and the common trap of thinking that creating a new admin account is the only way to recover access, ignoring the ability to add backup MFA devices.

This question tests the best practice for securing an AWS root user account while ensuring recovery from lost hardware MFA devices. The correct approach is to register multiple virtual or hardware MFA devices to provide redundancy.

Common mistake: Candidates often choose to create a new administrator account (Option C) because they mistakenly believe the root user cannot have multiple MFA devices or that creating a new account is the standard recovery procedure.

Expert Analysis

Why the Answer Is Correct

AWS allows you to register up to eight MFA devices for both the root user and IAM users. By adding multiple MFA devices (e.g., one hardware token and one virtual app on a phone), you ensure that if one device is lost, stolen, or broken, you can still authenticate using another registered device. This directly addresses the requirement to not lose access.

Why the Other Options Are Wrong

Creating a new administrator account (Option C) does not solve the problem of accessing the root account; it just gives you another admin. You would still be locked out of the root user. Attaching policies to other users (Option D) similarly doesn't help you log in as root. Option A suggests setting up a 'backup administrator account' which might imply sharing credentials or a separate login, but it doesn't restore root access and violates security principles of least privilege and separation of duties for critical infrastructure.

Community Comment Notes

The community overwhelmingly supports Option B, citing AWS documentation that explicitly recommends registering multiple MFA devices for flexibility and resiliency. One commenter noted that this provides "additional flexibility and resiliency" by allowing up to eight devices per identity.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for AWS-native features that enhance security without bypassing it. For MFA questions, remember that redundancy is key—registering multiple devices is a supported and recommended pattern for critical accounts like Root.

Frequently Asked Questions

Can I attach multiple hardware MFA tokens to one AWS root account?

Yes, AWS allows registering up to eight MFA devices of any type (virtual or hardware) for the root user to ensure redundancy.

Why is creating a new admin account wrong for root access?

A new admin account does not grant access to the root user credentials. If the root MFA is lost, only additional registered MFA devices for the root user can unlock it.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. hajra313 👍 11
    B. Add multiple MFA devices for the root user account to handle the disaster scenario. By adding multiple MFA devices for the root user account, the company ensures that it can still access the account even if one MFA device is lost. This approach provides a backup for authentication, addressing the concern of losing access to the root user account if the MFA device is lost.
  2. Scheldon 👍 3 Answered B
    AnswerB Because a root user can perform privileged actions, it's crucial to add MFA for the root user as a second authentication factor in addition to the email address and password as sign-in credentials. We strongly recommend enabling multiple MFA for your root user credentials to provide additional flexibility and resiliency in your security strategy. You can register up to eight MFA devices of any combination of the currently supported MFA types with your AWS account root user. https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html#ru-bp-mfa
  3. ad2dj28 👍 1 Answered B
    Your AWS account root user and IAM users can register up to eight MFA devices of any type. Registering multiple MFA devices can provide flexibility and help you reduce the risk of access interruption if a device is lost or broken. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html
  4. Andy_09 👍 4
    Option B
  5. NayeraB 👍 3 Answered B
    I'd go for B
Show 1 more comment
  1. asdfcdsxdfc 👍 2 Answered B
    b looks correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide