SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
A company is migrating a legacy application to AWS. The application uses a custom authentication mechanism that relies on LDAP. The company wants to minimize changes to the application. Which THREE services should the company consider for integrating LDAP authentication? (Choose THREE.)
⚠ Common exam trap
SAP-C02 often tests whether candidates recognize that Cognito user pools and IAM are not LDAP-compatible, and that only the three AWS Directory Service options provide LDAP endpoints for legacy applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Directory Service Simple AD
Options A, B, and C are correct because all three are AWS Directory Service offerings that expose LDAP endpoints the legacy application can bind to with minimal code changes. Simple AD (A) is a Samba 4-based, Microsoft AD-compatible directory that supports LDAP and Kerberos, so an app using LDAP authentication can point at it directly. AD Connector (B) is a proxy that forwards LDAP (and Kerberos) authentication requests to an existing on-premises Active Directory, letting the app keep using LDAP while credentials stay on-premises. AWS Directory Service for Microsoft Active Directory (C), i.e., AWS Managed Microsoft AD, runs actual Windows AD domain controllers that serve LDAP/LDAPS, so it natively satisfies LDAP-dependent authentication. Option D (Amazon Cognito user pools) is wrong because it is an OIDC/OAuth 2.0 identity provider for web/mobile apps, not an LDAP directory, and would require rewriting the app's authentication logic. Option E (IAM) is wrong because IAM handles AWS API authorization via SigV4 and federation (SAML/OIDC), not LDAP bind authentication for an application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Directory Service Simple AD
Why this is correct
Simple AD is an Samba-based managed directory that exposes standard LDAP and Kerberos endpoints in AWS, so the legacy application's existing LDAP calls work unmodified. This satisfies the minimise-changes constraint, though it lacks trusts and advanced Microsoft AD features.
- ✓
AWS Directory Service AD Connector
Why this is correct
AD Connector is a proxy that forwards LDAP and Kerberos authentication requests to an existing on-premises Microsoft Active Directory, so the legacy application keeps its current LDAP calls unchanged. This satisfies the minimise-changes constraint without replicating directory data into AWS.
- ✓
AWS Directory Service for Microsoft Active Directory
Why this is correct
AWS Directory Service for Microsoft Active Directory is a managed Microsoft AD in AWS that serves LDAP and Kerberos natively, so the legacy application authenticates without code changes. It satisfies the minimise-changes constraint while providing a full directory, unlike proxy-only options.
- ✗
Amazon Cognito user pools
Why it's wrong here
Cognito user pools authenticate against their own directory and federate via SAML or OIDC; they do not accept LDAP binds, so the application's LDAP mechanism would need rewriting. It tempts for customer-facing sign-in, where Cognito is the right choice, but not for minimising changes to an LDAP-dependent legacy app.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
IAM authenticates AWS principals through its own identity model and offers no LDAP directory bind, so the application's existing LDAP calls cannot be served. It tempts as the default AWS identity service, and would be correct for native AWS API authorisation, but not for preserving an application's LDAP authentication flow.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.