A security engineer discovers that a company's user passwords have no required minimum length. The company uses the following identity providers (IdPs): - AWS Identity and Access Management (IAM)…

Question

Options

• AUpdate the password length policy in the IAM configuration.
• BUpdate the password length policy in the Amazon Cognito configuration.
• CUpdate the password length policy in the on-premises Active Directory configuration.
• DCreate an SCP in AWS Organizations to enforce minimum password length.
• ECreate an IAM policy with a minimum password length condition.

• A
  8% (3)
• B
  73% (29)
• D
  5% (2)
• E
  15% (6)

Explanation

Explanation

When IAM is federated with on-premises Active Directory, authentication is handled by Active Directory itself - not IAM - so password policies must be enforced at the Active Directory level (Option C). For the Amazon Cognito user pool, which serves as its own independent user database, the minimum password length must be configured directly in the Cognito user pool password policy settings (Option B).

Why the distractors are wrong:

• Option A is incorrect because IAM's account password policy only applies to IAM users with console passwords, not federated users whose credentials are managed by Active Directory.
• Option D is incorrect because SCPs control AWS service actions and permissions, not user password construction policies.
• Option E is incorrect because IAM policies manage authorization (what actions users can perform), not authentication requirements like password length.

Memory Tip

Think "enforce where the identity lives" - federated users live in Active Directory (fix it there), Cognito users live in Cognito (fix it there). IAM is just the middleman for federation and doesn't own those passwords. If you control the source, you control the policy!

No community discussion yet for this question.