Exam AWS Certified SysOps Administrator - Associate topic 1 question 429 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 429
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company uses AWS Organizations to host several applications across multiple AWS accounts. Several teams are responsible for building and maintaining the infrastructure of the applications across the AWS accounts.

A SysOps administrator must implement a solution to ensure that user accounts and permissions are centrally managed. The solution must be integrated with the company's existing on-premises Active Directory environment. The SysOps administrator already has enabled AWS IAM Identity Center (AWS Single Sign-On) and has set up an AWS Direct Connect connection.

What is the MOST operationally efficient solution that meets these requirements?

A. Create a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
B. Create an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
C. Create an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
D. Use the built-in SSO directory as the identity source for IAM Identity Center. Copy the users and groups from the on-premises Active Directory domain. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.

Show Suggested Answer

Suggested Answer: C 🗳️

by mpl203 at March 21, 2024, 1:51 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

klayytech

Highly Voted 7 months, 1 week ago

Selected Answer: C

Here's why this option is the most efficient: Centralized Management: An AD Connector provides a centralized way to manage user identities from the existing on-premises Active Directory, reducing the need to create and manage separate user accounts in AWS. Reduced Operational Overhead: Compared to managing a separate AD domain controller on an EC2 instance (Option B) or copying users/groups to the built-in directory (Option D), using an AD Connector simplifies administration. Existing Integration: Since AWS Direct Connect is already established, connecting the on-premises AD through an AD Connector leverages the existing network connectivity.

upvoted 5 times

...

seetpt

Most Recent 6 months, 3 weeks ago

Selected Answer: C

ChatGPT says C

upvoted 2 times

...

mpl203

7 months, 1 week ago

Selected Answer: D

https://docs.aws.amazon.com/singlesignon/latest/userguide/quick-start-default-idc.html

upvoted 2 times

klayytech

7 months, 1 week ago

D. Built-in SSO directory: Copying users and groups can be time-consuming and error-prone, especially for large teams. Additionally, any changes in on-premises AD wouldn't automatically reflect in the IAM Identity Center, requiring manual updates.

upvoted 1 times

...

Exam AWS Certified SysOps Administrator - Associate All Questions

View all questions & answers for the AWS Certified SysOps Administrator - Associate exam

Exam AWS Certified SysOps Administrator - Associate topic 1 question 429 discussion

Comments

klayytech

seetpt

mpl203

klayytech

SY0-701