Q36 — AWS SAA-C03 Ch.6

Question 36 of 65 | ← Chapter 6

Q401. A company wants to provide users with access to AWS resources. The company has 1,500 users and manages their access to on-premises resources through Active Directory user groups on the corporate network. However, the company does not want users to have to maintain another identity to access the resources. A solutions architect must manage user access to the AWS resources while preserving access to the on-premises resources.What should the solutions architect do to meet these requirements?

• A. Create an IAM user for each user in the company. Attach the appropriate policies to each user.
• B. Use Amazon Cognito with an Active Directory user pool Create roles with the appropriate policies attached.
• C. Define cross-account roles with the appropriate policies attached. Map the roles to the Active Directory groups.
• D. Configure Security Assertion Markup Language (SAML)20-based federation. Create roles with the appropriate policies attached. Map the roles to the Active Directory groups. ✓

Correct Answer: D. Configure Security Assertion Markup Language (SAML)20-based federation. Create roles with the appropriate policies attached. Map the roles to the Active Directory groups.

Explanation

To meet the requirements of providing users with access to AWS resources while preserving access to on- premises resources, the solutions architect should configure SAML 2.0-based federation. This allows for single sign-on (SSO) using the existing Active Directory user groups on the corporate network. By configuring SAML 2.0-based federation, users can authenticate using their existing corporate credentials and access both on-premises and AWS resources without the need for maintaining separate identities. Roles with the appropriate policies can be created and mapped to the Active Directory groups, ensuring that users have the appropriate access to AWS resources based on their group membership.