SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?
⚠ Common exam trap
It's easy for candidates to confuse AD Connector (a proxy) with a trust relationship, thinking it provides the same level of integration, but AD Connector does not support native Kerberos trusts or scalable authentication for AWS Managed Microsoft AD migration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.
AWS Managed Microsoft AD can establish a forest trust with an on-premises Active Directory, allowing users to authenticate using their existing corporate credentials. This approach is secure (Kerberos-based trust, no password exposure) and scalable (AWS handles AD infrastructure). IAM roles can then be mapped to AD groups via SAML or IAM Identity Center for fine-grained access to AWS resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Federate using SAML 2.0 with on-premises ADFS and map AD groups to IAM roles.
Why it's wrong here
SAML federation is for web console access, not for EC2 domain join or other AWS services that require AD.
- ✗
Deploy AD Connector in each VPC to proxy authentication requests to on-premises Active Directory.
Why it's wrong here
AD Connector does not provide a managed directory; it only proxies requests, which may increase latency.
- ✓
Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.
Why this is correct
AWS Managed Microsoft AD supports trust relationships and can be used for IAM authentication.
- ✗
Use AWS Directory Service Simple AD and synchronize with on-premises Active Directory using AD Connector.
Why it's wrong here
Simple AD is a Samba-based directory, not full Active Directory; it cannot join EC2 instances to the domain.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.