SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
A company is migrating a large .NET application to AWS. The application uses Windows authentication and integrates with Active Directory. The company wants to minimize operational overhead for the directory service. The on-premises Active Directory is already synchronized to AWS using AWS Directory Service for Microsoft Active Directory. During migration, the application fails to authenticate users. The security team confirms that the on-premises AD and AWS Managed AD are in sync. The application is running on EC2 instances that are joined to the AWS Managed AD domain. The application logs show authentication errors. What is the most likely cause of the authentication failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is using a service account that is not in the AWS Managed AD.
The most likely cause is that the application is using a service account that is not present in AWS Managed AD. While the on-premises AD is synchronized, the specific service account may not have been replicated or may have been excluded from synchronization. Without the correct service account, Windows authentication will fail. NTLM is enabled by default in AWS Managed AD, so option A is incorrect. The security group must allow LDAP traffic (port 389) for domain-joined instances; if instances are joined, this is already configured, making option B unlikely. EC2 instances must resolve the domain controller DNS to join the domain; since they are joined, DNS resolution is working, so option C is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application requires NTLM authentication, which is disabled by default.
Why it's wrong here
NTLM is enabled by default in AWS Managed AD.
- ✗
The security group does not allow traffic on port 389 (LDAP).
Why it's wrong here
Port 389 is for LDAP, but authentication uses Kerberos (port 88) or NTLM.
- ✗
The EC2 instances cannot resolve the domain controller DNS name.
Why it's wrong here
If domain-joined, DNS should work.
- ✓
The application is using a service account that is not in the AWS Managed AD.
Why this is correct
Common cause: service account not migrated or created.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.