SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?
⚠ Common exam trap
Many candidates confuse IAM identity providers (Option A) with Active Directory trust relationships, or they incorrectly assume that storing credentials in Parameter Store (Option C) is a valid authentication strategy for directory integration, when in fact the correct approach is to establish a forest trust and share the directory via RAM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.
Establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an IAM identity provider to use the on-premises Active Directory.
Why it's wrong here
IAM identity providers are for federating AWS API access, not for application-level authentication.
- ✓
Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.
Why this is correct
This enables users to authenticate with their existing credentials.
- ✗
Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.
Why it's wrong here
Parameter Store is not designed for AD authentication integration.
- ✓
Use AWS Resource Access Manager to share the AWS Managed Microsoft AD directory with other accounts in the organization.
Why this is correct
RAM allows the directory to be used by multiple accounts.
- ✗
Deploy AWS Managed Microsoft AD in each account and configure replication.
Why it's wrong here
Deploying AWS Managed Microsoft AD in each account and configuring replication fails to provide a single, centralised identity store for seamless authentication across the AWS Organisation, instead creating isolated directories. This approach does not leverage the directory sharing capabilities of AWS Managed Microsoft AD. It is tempting because AD replication is fundamental for high availability and fault tolerance within a single Active Directory domain. This option would be appropriate if distinct, isolated AD environments were required for separate business units without any cross-account authentication needs from a shared directory.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.