Q41 — AWS SCS-C02 Ch.1

Question 41 of 100 | ← Chapter 1

A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certicate, users saw the following message when trying to log in: Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken) A security engineer needs to provide a solution that corrects the error and minimizes operational overhead.  Which solution meets these requirements?

• A. Upload the third-party signing certicate＆rsquo;s new private key to the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS Management Console.
• B. Sign the identity provider＆#39;s metadata le with the new public key. Upload the signature to the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS CLI.
• C. Download the updated SAML metadata le from the identity service provider. Update the le in the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS CLI. ✓
• D. Congure the AWS identity provider entity dened in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.

Correct Answer: C. Download the updated SAML metadata le from the identity service provider. Update the le in the AWS identity provider entity dened in AWS Identity and Access Management (IAM) by using the AWS CLI.

Explanation

AWS环境中使用第三方身份提供商和基于SAML的SSO时，身份提供商更新签名证书后，AWS必须同步最新证书以确保SAML响应验证通过。AWS文档指出，IAM中的身份提供商实体需包含身份提供商的元数据文件，其中包含公钥证书。当证书更新后，需重新下载该元数据文件并更新IAM配置。选项C通过AWS CLI更新元数据文件，符合操作流程。其他选项涉及私钥（不安全）、签名步骤（多余）或自动同步（无此默认功能），均不符合要求。