A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations. A security engineer needs to set up delegated administration of…

Question

Options

• AGrant least privilege access to the organization's management account.
• BCreate a new IAM Identity Center directory in the organization's management account.
• CSet up a second AWS Region in the organization's management account.
• DCreate permission sets for use only in the organization's management account.
• ECreate IAM users for use only in the organization's management account.
• FCreate user assignments only in the organization's management account.

• A
  8% (2)
• B
  69% (18)
• C
  19% (5)
• E
  4% (1)

Explanation

AWS IAM Identity Center delegated administration requires foundational configuration to be completed in the organization's management account before delegation. According to the AWS Certified Security - Specialty documentation, IAM Identity Center must be enabled with a directory in the management account before any delegation can occur. Permission sets must be created in the management account because they define the permissions that will later be delegated to member accounts. Additionally, user assignments must initially exist in the management account to establish baseline access control before delegation is Option A is too generic and not a required prerequisite step. Option C is unrelated to Identity Center delegation. Option E is incorrect because IAM Identity Center uses identities from its directory or external IdPs, not IAM users. AWS guidance clearly outlines directory creation, permission set definition, and initial user assignments as mandatory preparatory steps for delegated administration.

No community discussion yet for this question.