CLF-C02 Security and Compliance Practice Question
A company manages multiple AWS accounts using AWS Organizations. The company has an on-premises Microsoft Active Directory (AD) that contains employee credentials and group memberships. The company wants to grant employees access to the AWS Management Console and command-line interface (CLI) using their existing AD credentials, without creating IAM users for each employee. Additionally, the company wants to centrally manage permissions across all accounts by assigning policies to AD groups. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse AWS Directory Service for Microsoft Active Directory with IAM Identity Center, thinking that a managed AD alone can provide cross-account access and SSO, but Directory Service only provides the directory backend and lacks the centralized permission assignment and federation capabilities that IAM Identity Center offers for multi-account environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Identity Center (AWS Single Sign-On)
AWS IAM Identity Center (formerly AWS Single Sign-On) is the correct service because it allows centralized management of user access to multiple AWS accounts and applications using existing corporate credentials from Microsoft Active Directory. It supports federation with AD via SAML 2.0 or SCIM, enabling employees to sign in to the AWS Management Console and CLI without creating IAM users. Permissions can be assigned to AD groups through permission sets, which map to IAM roles, ensuring consistent policy enforcement across all accounts in AWS Organizations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
IAM is used for managing users and permissions within a single AWS account. It does not natively federate with an external identity provider to provide cross-account SSO, and it requires creating IAM users, which does not meet the requirement to use existing AD credentials without creating separate users.
When this WOULD be correct
A company needs to create and manage IAM users and groups directly within AWS, with no requirement to use existing on-premises AD credentials or centralize permissions across multiple accounts.
- ✗
AWS Directory Service for Microsoft Active Directory
Why it's wrong here
AWS Directory Service for Microsoft AD sets up a managed Active Directory in the AWS cloud. While it can be used as an identity source, it does not by itself provide the cross-account SSO or permission management across multiple AWS accounts that the company needs. An additional service like IAM Identity Center is required for that.
When this WOULD be correct
A company needs to set up a managed Microsoft Active Directory in AWS to support domain-joined EC2 instances or applications that require LDAP authentication, without requiring cross-account access or AWS policy assignment to AD groups.
- ✓
AWS IAM Identity Center (AWS Single Sign-On)
Why this is correct
IAM Identity Center is the correct service for this use case. It connects to an existing identity provider (such as on-premises Active Directory), enables single sign-on to the AWS Management Console and CLI, and centrally manages permissions across all accounts in AWS Organizations by assigning permission sets to groups.
- ✗
AWS Resource Access Manager (AWS RAM)
Why it's wrong here
AWS RAM allows you to share AWS resources such as subnets or Route 53 rules across accounts. It does not handle user identity, authentication, or permissions management, so it cannot provide SSO or centrally manage user access to accounts.
When this WOULD be correct
A company needs to share a centrally managed VPC subnet or a license configuration with multiple accounts in AWS Organizations, without duplicating the resource in each account.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS IAM Identity Center (AWS Single Sign-On)Correct answer▾
Why this is correct
IAM Identity Center is the correct service for this use case. It connects to an existing identity provider (such as on-premises Active Directory), enables single sign-on to the AWS Management Console and CLI, and centrally manages permissions across all accounts in AWS Organizations by assigning permission sets to groups.
✗AWS Identity and Access Management (IAM)Wrong answer — click to see why▾
Why this is wrong here
IAM alone cannot integrate with on-premises Active Directory for authentication, nor can it centrally manage permissions across multiple AWS accounts without federation or Identity Center.
★ When this WOULD be the correct answer
A company needs to create and manage IAM users and groups directly within AWS, with no requirement to use existing on-premises AD credentials or centralize permissions across multiple accounts.
Why candidates choose this
Candidates may think IAM is the default for access management and overlook the need for federation and multi-account centralization, assuming IAM can handle AD integration via custom solutions.
✗AWS Directory Service for Microsoft Active DirectoryWrong answer — click to see why▾
Why this is wrong here
AWS Directory Service for Microsoft Active Directory only provides the directory service; it does not offer the centralized permission management across multiple AWS accounts or the ability to assign AWS policies to AD groups. The company needs IAM Identity Center to integrate with AD and manage cross-account access.
★ When this WOULD be the correct answer
A company needs to set up a managed Microsoft Active Directory in AWS to support domain-joined EC2 instances or applications that require LDAP authentication, without requiring cross-account access or AWS policy assignment to AD groups.
Why candidates choose this
Candidates see 'Microsoft Active Directory' and 'existing AD credentials' and assume that AWS Directory Service is the direct integration point, overlooking that IAM Identity Center is the service that bridges AD with AWS account permissions.
✗AWS Resource Access Manager (AWS RAM)Wrong answer — click to see why▾
Why this is wrong here
AWS Resource Access Manager (RAM) is used to share resources like subnets or transit gateways across accounts, not to manage user authentication or permissions via Active Directory groups.
★ When this WOULD be the correct answer
A company needs to share a centrally managed VPC subnet or a license configuration with multiple accounts in AWS Organizations, without duplicating the resource in each account.
Why candidates choose this
Candidates may confuse 'resource sharing' with 'access management' because both involve cross-account permissions, but RAM focuses on sharing specific AWS resources, not user identities or SSO.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.