A company's Security department established new requirements that state internal users must connect to an existing Amazon RDS for SQL Server DB instance using their corporate Active Directory (AD)…

Question

Options

• ADisable Transparent Data Encryption (TDE) on the RDS SQL Server DB instance.
• BModify the RDS SQL Server DB instance to use the directory for Windows authentication. Create
• CUse the AWS Management Console to create an AWS Managed Microsoft AD. Create a trust
• DStop the RDS SQL Server DB instance, modify it to use the directory for Windows authentication,
• EUse the AWS Management Console to create an AD Connector. Create a trust relationship with
• FConfigure the AWS Managed Microsoft AD domain controller Security Group.

• A
  5% (1)
• B
  82% (18)
• D
  5% (1)
• E
  9% (2)

Explanation

Windows Authentication for RDS SQL Server with Active Directory

To enable corporate AD credentials for RDS SQL Server, you need three key components: an AWS Managed Microsoft AD (not an AD Connector) to act as the managed directory in AWS, a trust relationship between the AWS Managed Microsoft AD and the on-premises corporate AD so credentials can federate, and modifying the RDS instance to use that directory for Windows authentication - all without stopping the instance. Finally, configuring the AWS Managed Microsoft AD domain controller Security Group is required to allow the necessary network traffic between RDS and the directory service.

Why the Distractors Are Wrong:

• A – TDE relates to encryption at rest and has no bearing on authentication method; disabling it is unnecessary and counterproductive.
• D – RDS SQL Server does not require you to stop the instance to modify authentication settings; this is a managed service and the change can be made while running.
• E – An AD Connector simply proxies requests to on-premises AD and is not the recommended solution for RDS Windows authentication; AWS Managed Microsoft AD is required for native integration with RDS.

Memory Tip:

Think "Create, Connect, Configure" - Create the AWS Managed Microsoft AD with a trust, B connect RDS to the directory (without stopping it), and F configure the Security Group to open the network path.

No community discussion yet for this question.