SAP-C02 Question 600
Single answerYour company uses AWS and has a hybrid environment with on-premises Active Directory (AD) for user management. They want to allow users to sign in to the AWS Management Console using their existing on-premises AD credentials while minimizing the need to manage separate credentials in AWS. Which solution should you implement to meet this requirement?
- A
Configure AWS IAM Identity Center to connect directly to the on-premises Active Directory using AD Connector.
- B
Use AWS Directory Service Simple AD to synchronize with the on-premises Active Directory for user management.
- C
Set up AWS Directory Service AD Connector to connect to the on-premises Active Directory and enable single sign-on (SSO) through IAM Identity Center.
- D
Manually create IAM user accounts for each on-premises Active Directory user and assign them IAM policies.
Show answer and explanation
Correct answer: C
Explanation
The best solution for integrating an on-premises Active Directory with AWS for user sign-in is to use AWS Directory Service AD Connector. AD Connector serves as a proxy that allows AWS to authenticate users against the on-premises AD without storing credentials in the cloud. Coupled with AWS IAM Identity Center, it enables single sign-on (SSO) to the AWS Management Console using existing AD credentials. This approach avoids the need to manage separate IAM user accounts or credentials, aligning with the requirement.
- A. Incorrect.
Incorrect. While AWS IAM Identity Center can integrate with Active Directory, it requires AWS Directory Service AD Connector or AWS Managed Microsoft AD to establish the connection to the on-premises AD.
- B. Incorrect.
Incorrect. AWS Directory Service Simple AD is not designed to integrate with an on-premises Active Directory. It is a standalone directory service for applications requiring basic AD compatibility.
- C. Correct.
Correct. AWS Directory Service AD Connector allows you to connect your on-premises Active Directory to AWS, enabling seamless single sign-on (SSO) for users via IAM Identity Center without managing separate credentials.
- D. Incorrect.
Incorrect. Creating and managing separate IAM user accounts for each on-premises AD user would not meet the requirement of minimizing credential management and is not a scalable solution.