SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
A company is refactoring a legacy .NET application to run on AWS Lambda. The application currently uses Windows authentication and Active Directory. Which approach should the company use to support authentication in the new architecture?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Directory Service for Microsoft Active Directory and connect Lambda to the directory via VPC.
B is correct because AWS Directory Service for Microsoft Active Directory allows Lambda functions to authenticate users against an existing Active Directory. By connecting the Lambda function to the directory via a VPC, the function can perform Windows authentication for the refactored .NET application. Option A is incorrect because Amazon Cognito user pools are designed for external identity providers, not for Windows AD authentication. Option C is incorrect because IAM roles are used for granting AWS service permissions, not for authenticating users with Windows credentials. Option D is incorrect because STS issues temporary tokens for AWS API access, not for Windows authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon Cognito user pools for authentication.
Why it's wrong here
Cognito is for external user identities, not Windows authentication.
- ✓
Use AWS Directory Service for Microsoft Active Directory and connect Lambda to the directory via VPC.
Why this is correct
This enables Kerberos/NTLM authentication within the VPC.
- ✗
Use AWS Identity and Access Management (IAM) roles to authenticate users.
Why it's wrong here
IAM roles are for AWS service access, not application-level Windows auth.
- ✗
Use AWS Security Token Service (STS) to issue tokens for authentication.
Why it's wrong here
STS issues temporary credentials, not authentication tokens for Windows.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.