You are working for a company and been allocated the task for ensuring that there is a federated authentication mechanism setup between AWS and their On-premise Active Directory. Which of the…

Question

Options

• AEnsure the right match is in place for On-premise AD Groups and IAM Roles.
• BEnsure the right match is in place for On-premise AD Groups and IAM Groups.
• CConfigure AWS as the relying party in Active Directory
• DConfigure AWS as the relying party in Active Directory Federation services

• A
  83% (25)
• B
  10% (3)
• C
  7% (2)

Explanation

In federated authentication with ADFS, on-premise AD Groups map directly to IAM Roles (not IAM Groups), because federated users assume temporary permissions via role assumption - there are no permanent IAM user accounts involved, making option A correct and option B wrong. Option D is correct because AWS must be registered as a Relying Party Trust specifically within AD Federation Services (ADFS), which is the component that issues and signs SAML tokens; option C is wrong because bare Active Directory has no concept of relying parties - that trust relationship belongs in ADFS, not AD itself.

Memory tip: Think "Roles for federation, ADFS for the trust" - federated identities always assume roles (temporary), and the federation token magic happens in ADFS, not plain AD.

No community discussion yet for this question.