SCS-C03 Identity and Access Management Practice Question
A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An IAM SAML Identity Provider entity created in the AWS account.
SAML 2.0 federation allows users to use their existing corporate credentials to access the AWS Management Console. This centralizes identity management and reduces the need for multiple sets of credentials. Configuring the trust relationship involves exchanging metadata between the Identity Provider and AWS, ensuring that the assertion contains the necessary attributes for role mapping and session management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An IAM User with programmatic access keys for the Identity Provider.
Why it's wrong here
SAML federation is a provider-based trust and does not require a specific IAM user with access keys. The Identity Provider (IdP) interacts with the AWS STS service directly via the SAML assertion, making static user credentials unnecessary for the federation process itself to function correctly.
- ✗
A CloudFront distribution to cache the SAML assertion responses.
Why it's wrong here
CloudFront is a content delivery network and is not involved in the SAML authentication flow. The SAML assertion is passed directly from the user's browser to the AWS sign-in endpoint. Caching these assertions would be a security risk and is not part of the standard SAML architecture.
- ✓
An IAM SAML Identity Provider entity created in the AWS account.
Why this is correct
You must create a SAML Identity Provider entity in IAM to establish the trust between your AWS account and your external IdP. This entity is configured by uploading the SAML metadata document provided by your IdP, which contains the public keys and endpoints needed for secure communication.
- ✗
An Amazon Cognito User Pool to store the federated user profiles.
Why it's wrong here
While Amazon Cognito can be used for federation in mobile or web applications, it is not a requirement for standard SAML 2.0 federation to the AWS Management Console. Direct federation uses IAM SAML providers and roles, bypassing the need for a Cognito User Pool to manage those identities.
- ✓
An IAM Role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action.
Why this is correct
A specific IAM role must be created that the federated users will assume. The trust policy of this role must specify the SAML provider as a principal and allow the 'sts:AssumeRoleWithSAML' action, ensuring that only authenticated users from your corporate IdP can obtain temporary AWS credentials.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.