What is a recommended practice for the ACCOUNTADMIN role to avoid long password reset procedures?

• A. Assign to this role to a single user
• B. Require multi-factor authentication for login
• C. Assign to at least two users
• D. Never use account admin role

Answer: (C)

Having at least two people with ACCOUNTADMIN provides redundancy for a highly privileged role. This role controls all objects and security in the account, so if the sole holder’s password needs resetting, leaves, or is otherwise unavailable, critical admin work could be delayed. Distributing this access to two or more trusted users ensures quicker recovery, avoids a single point of failure, and supports emergency access procedures without waiting on a single password reset.

Assigning it to just one user creates a bottleneck and a potential downtime gap. Requiring multi-factor authentication is a strong security practice, but it doesn’t directly address the problem of what happens if the password reset takes time. Never using the ACCOUNTADMIN role isn’t feasible for required administrative tasks, and using it with only one person reintroduces the single point of failure.