SAA-C03 · Question #161
A company that has multiple AWS accounts maintains an on-premises Microsoft Active Directory. The company needs a solution to implement Single Sign-On for its employees. The company wants to use AWS…
The correct answer is C. IAM Identity Center + Existing AD:Best approach to integrate existing Active Directory for. IAM Identity Center with an existing Active Directory connection is correct because it directly satisfies all three requirements: it federates with on-premises AD so employees use existing credentials, it natively enforces MFA, and it provides a central console to manage access…
Question
A company that has multiple AWS accounts maintains an on-premises Microsoft Active Directory. The company needs a solution to implement Single Sign-On for its employees. The company wants to use AWS IAM Identity Center. The solution must meet the following requirements:
Allow users to access AWS accounts and third-party applications by using existing Active Directory credentials. Enforce multi-factor authentication (MFA) to access AWS accounts. Centrally manage permissions to access AWS accounts and applications. Which solution will meet these requirements?
Options
- AIAM identity provider:Does not support centralized management across multiple accounts.
- BAWS Managed AD:Unnecessary if an on-premises Active Directory already exists.
- CIAM Identity Center + Existing AD:Best approach to integrate existing Active Directory for
- DLambda for synchronization:Adds complexity and does not leverage IAM Identity Center
How the community answered
(40 responses)- A5% (2)
- B3% (1)
- C85% (34)
- D8% (3)
Explanation
IAM Identity Center with an existing Active Directory connection is correct because it directly satisfies all three requirements: it federates with on-premises AD so employees use existing credentials, it natively enforces MFA, and it provides a central console to manage access across multiple AWS accounts and SAML-compatible third-party apps.
Option A (IAM identity provider) operates at the individual account level - it can't centrally manage permissions across multiple AWS accounts, which breaks the multi-account requirement. Option B (AWS Managed AD) creates a new managed directory in AWS, which is redundant and adds cost when an on-premises AD already exists. Option D (Lambda synchronization) is a hand-rolled solution that bypasses IAM Identity Center's native federation capabilities, introducing unnecessary complexity without the built-in MFA enforcement or centralized permission management.
Memory tip: Think of IAM Identity Center as the "SSO hub" - whenever a question mentions multiple accounts + existing identity provider + centralized access, IAM Identity Center with a connected AD (via AD Connector or trust relationship) is almost always the answer. The keyword phrase to watch for is "existing Active Directory credentials," which rules out creating a new directory.
Topics
Community Discussion
No community discussion yet for this question.