Q52 — AWS SAA-C03 Ch.12

Question 52 of 100 | ← Chapter 12

Q852. A company is migrating applications from an on-premises Microsoft Active Directory that the company manages to AWS. The company deploys the applications in multiple AWS accounts. The company uses AWS Organizations to manage the accounts centrally.The company's security team needs a single sign-on solution across all the company's AWS accounts. The company must continue to manage users and groups that are in the on-premises Active Directory.Which solution will meet these requirements?

Correct Answer: B. Enable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory.

Explanation

To meet the requirement of a single sign-on solution across all of the company's AWS accounts while continuing to manage users and groups in the on-premises Microsoft Active Directory, the recommended solution is:B. Enable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory.Here's why:Option B suggests enabling AWS IAM Identity Center and configuring a two-way forest trust relationship between the company's self-managed Active Directory and IAM Identity Center using AWS Directory Service for Microsoft Active Directory.IAM Identity Center is a feature of AWS Identity and Access Management (IAM) that provides a single sign-on (SSO) solution for AWS accounts. By configuring a two-way forest trust relationship, you establish a connection between the on-premises Active Directory and IAM Identity Center, allowing users and groups from the Active Directory to be used for authentication and authorization in AWS.AWS Directory Service for Microsoft Active Directory is used to facilitate the trust relationship between the on-premises Active Directory and IAM Identity Center.This solution meets the requirement of a single sign-on solution across all of the company's AWS accounts while leveraging the existing user and group management capabilities of the on-premises Active Directory.Option A suggests creating an Enterprise Edition Active Directory in AWS Directory Service and configuring it as the identity source for AWS IAM Identity Center. However, this option does not address the requirement of integrating with the company's self-managed Active Directory.Option C suggests using AWS Directory Service and creating a two-way trust relationship with the company's self-managed Active Directory, which aligns with the recommended solution.Option D suggests deploying an identity provider (IdP) on Amazon EC2 and linking it as an identity source within AWS IAM Identity Center. This option does not utilize AWS Directory Service and would require additional configuration and management of the IdP.In summary, option B provides a solution by enabling AWS IAM Identity Center, configuring a two-way forest trust relationship, and leveraging AWS Directory Service for Microsoft Active Directory. This allows for a single sign-on solution across all of the company's AWS accounts while managing users and groups in the on-premises Active Directory.