SCS-C03 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an IAM SAML identity provider in the AWS account using the metadata document provided by the corporate IdP.

  Why this is correct

  The IAM SAML identity provider is a resource that tells AWS about your external IdP. By uploading the XML metadata document from your IdP, AWS can verify the digital signatures on SAML assertions sent by your organization. This is the foundational step for establishing the cryptographic trust between both parties.

• ✓

  Configure the corporate IdP to send SAML assertions that include the 'Role' and 'RoleSessionName' attributes.

  Why this is correct

  AWS requires specific SAML attributes to perform the federation. The 'Role' attribute contains the ARNs of the IAM role and the SAML provider, while 'RoleSessionName' provides an identifier for the session, often the email address. Without these specific mappings, AWS cannot determine which role the user is authorized to assume.

• ✗

  Install the AWS CLI on each employee's local machine and configure it with their corporate username and password.

  Why it's wrong here

  Standard SAML federation for the AWS Console is browser-based and does not require the AWS CLI or local configuration of corporate credentials. While CLI federation is possible using tools like 'aws-adfs', it is not a requirement for establishing the core trust relationship or for basic Management Console access.

• ✗

  Enable Multi-Factor Authentication (MFA) on the AWS root user to allow SAML assertions to be processed securely.

  Why it's wrong here

  While securing the root user with MFA is a critical security best practice, it has no technical impact on the functionality of SAML federation. SAML authentication is handled by the external Identity Provider, and the resulting assertions are processed by the IAM service independently of the root account configuration.

• ✗

  Create individual IAM users for every employee and map them to their corresponding corporate identities using tags.

  Why it's wrong here

  The primary goal of federation is to avoid creating individual IAM users for every employee. Instead, users are mapped to IAM roles dynamically upon login. This reduces administrative overhead and ensures that employee access is automatically revoked when they are deactivated in the corporate directory, improving the overall security posture.