What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account? (Choose two.)

Using root user access keys introduces the most dangerous form of AWS credential. If these keys are leaked, an attacker gains unrestricted access to the entire account with no ability to scope or revoke permissions through IAM policies.

Enabling MFA for IAM users with AdministratorAccess is a good practice, but it does not protect the root user itself. The root user is a separate identity that requires its own MFA configuration.

AWS KMS does not provide a mechanism to encrypt IAM access keys or set automatic rotation for them. Access key rotation is managed through the IAM console or API, and KMS encryption is not applicable to credential management in this way.

AWS root user access keys provide programmatic access with unlimited, unconstrained permissions and cannot be restricted by IAM policies. Avoiding their creation and using IAM users with appropriate permissions instead eliminates the highest-risk credential that could be used to completely compromise the account.

Enabling MFA for the root user requires a physical or virtual token in addition to a password, making account takeover significantly harder even if the root password is compromised. AWS explicitly recommends MFA as a mandatory control for the root user.