SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
A company is migrating a large-scale .NET application to AWS. The application uses Windows authentication and requires Active Directory integration. The company wants to reduce operational overhead. Which migration approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rehost on EC2 with AWS Managed Microsoft AD
(Rehost on EC2 with AWS Managed Microsoft AD) is correct because it provides Active Directory integration without the need to manage domain controllers, reducing operational overhead. Option A (Rehost on EC2 with on-premises AD via VPN) still requires managing on-premises resources and doesn't fully reduce overhead. Option C (Replatform to use Amazon Cognito) is aimed at web identity federation, not traditional Windows AD authentication. Option D (Replatform to AWS Elastic Beanstalk with Amazon Lightsail) does not support Windows authentication or AD integration effectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rehost on EC2 with on-premises AD via VPN
Why it's wrong here
Rehosting on EC2 with on-premises AD over VPN keeps directory servers and VPN infrastructure under the company's operational responsibility, so overhead is not reduced. It is tempting as the lowest-effort path when workloads must retain existing domain membership and no cloud directory exists.
- ✓
Rehost on EC2 with AWS Managed Microsoft AD
Why this is correct
AWS Managed Microsoft AD provides the domain services and Kerberos-based Windows authentication the .NET application requires, while AWS handles patching, replication and domain controller availability. Rehosting on EC2 preserves the existing application without code changes, and the managed directory removes the operational overhead of self-managed AD.
- ✗
Replatform to use Amazon Cognito for authentication
Why it's wrong here
Amazon Cognito handles customer-facing web and mobile identity, not Kerberos or domain-joined Windows authentication, so the .NET application's AD integration breaks. It is tempting because it removes directory management, and it is correct for new consumer applications needing social or federated sign-in.
- ✗
Replatform to AWS Elastic Beanstalk with Amazon Lightsail
Why it's wrong here
Elastic Beanstalk with Lightsail provides no Active Directory domain services, so Windows authentication cannot function; Lightsail is also aimed at simple workloads, not large-scale .NET estates. It is tempting as a low-management hosting option, correct for small applications without domain dependencies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.