SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
A company is modernizing a legacy .NET application by containerizing it on Amazon ECS. The application currently uses Windows authentication against on-premises Active Directory. After migrating, the application needs to authenticate users against AWS Managed Microsoft AD. The security team requires that credentials never leave the corporate network. Which solution should the company implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up AWS Managed Microsoft AD with a two-way trust to on-premises AD over Direct Connect.
The correct solution is D. By setting up AWS Managed Microsoft AD with a two-way trust to on-premises Active Directory over Direct Connect, user authentication can be performed against the on-premises AD while credentials remain within the corporate network. The trust relationship allows the on-premises AD to authenticate users without credentials leaving the network. Option A is incorrect because storing passwords in Secrets Manager and authenticating against it would require credentials to leave the corporate network, violating the security requirement. Option B, AD Connector, proxies authentication requests to on-premises AD but still requires credentials to be passed through the proxy, which may not satisfy the security policy. Option C, Simple AD, does not support trusts and is not compatible with on-premises AD integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store user passwords in AWS Secrets Manager and authenticate against it.
Why it's wrong here
Not integrated with on-premises AD.
- ✗
Use AWS AD Connector to proxy authentication to on-premises AD.
Why it's wrong here
AD Connector passes credentials to AWS.
- ✗
Use AWS Directory Service Simple AD with password sync.
Why it's wrong here
Simple AD cannot sync passwords.
- ✓
Set up AWS Managed Microsoft AD with a two-way trust to on-premises AD over Direct Connect.
Why this is correct
Keeps credentials on-premises.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.