SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?
⚠ Common exam trap
Candidates often confuse IAM SAML federation (which works for a single account) with IAM Identity Center (which is the correct multi-account SSO solution), leading them to select Option D because they know SAML 2.0 is supported, but they miss the requirement for multiple AWS accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Identity Center.
AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Directory Service for Microsoft Active Directory.
Why it's wrong here
Directory Service is for AD-based identity, not SAML federation.
- ✗
Amazon Cognito user pools.
Why it's wrong here
Cognito is for external user identity, not enterprise SSO for AWS accounts.
- ✓
AWS IAM Identity Center.
Why this is correct
IAM Identity Center integrates with SAML 2.0 IdPs and provides SSO across multiple AWS accounts.
- ✗
AWS Identity and Access Management (IAM) with SAML federation.
Why it's wrong here
IAM SAML federation directly establishes trust between an external SAML 2.0 IdP and a *single* AWS account, allowing users to assume roles within it. This option fails for multiple AWS accounts, as it lacks a centralised service to manage federated access across an entire AWS Organisation. It is tempting because it correctly identifies SAML federation and is the appropriate method for granting SSO access to a solitary AWS account.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.