CLF-C02 Question 117
Single answerA company wants its employees to access AWS resources using their corporate credentials stored in an on-premises Active Directory. Which solution should the company use to achieve this?
- A
Set up AWS Identity and Access Management (IAM) users for each employee and manually assign permissions.
- B
Configure AWS Single Sign-On (SSO) with Active Directory Federation Services (AD FS).
- C
Use AWS Key Management Service (KMS) to sync credentials between AWS and the on-premises Active Directory.
- D
Create an Amazon Cognito user pool and migrate all corporate credentials into the pool.
Show answer and explanation
Correct answer: B
Explanation
Federated identity management allows organizations to utilize existing identity providers, such as Active Directory, for accessing AWS resources. AWS Single Sign-On (SSO) integrated with Active Directory Federation Services (AD FS) is the appropriate solution in this scenario because it enables employees to use their corporate credentials without creating separate IAM users in AWS.
- A. Incorrect.
Setting up individual IAM users for each employee is not scalable or efficient for large organizations, especially when they already have an existing identity store like Active Directory.
- B. Correct.
Configuring AWS Single Sign-On (SSO) with Active Directory Federation Services (AD FS) enables employees to use their corporate credentials to securely access AWS resources through federated identity management.
- C. Incorrect.
AWS Key Management Service (KMS) is used for encryption and key management, not for identity federation or credential synchronization.
- D. Incorrect.
Amazon Cognito user pools are used for managing user authentication for web and mobile apps, but this would require migrating corporate credentials, which is not ideal or necessary for this scenario.