Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Associate · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
I choose A, because it's telling about continue managing the users and groups in its on-premise, means 1 way trust is sufficient to delegate this requirement
Its A: Chat GPT. Answer: A. Enable AWS SSO (IAM Identity Center) and connect it to your on-prem AD via AWS Managed Microsoft AD with a one-way trust. Why A is right (least privilege, least ops): IAM Identity Center natively provides SSO across all AWS Organizations accounts. Keep users/groups in on-prem AD; establish a one-way trust so AWS Managed Microsoft AD trusts your on-prem AD (users authenticate in AD, permissions assigned in Identity Center). No need for extra IdP or broad two-way trusts. Why not the others B (two-way trust): Works, but not required and violates least privilege. C (Directory Service only): Doesn’t give org-wide SSO by itself; you still need Identity Center. D (deploy on-prem IdP): Unnecessary complexity—Identity Center + Managed Microsoft AD already solves it.
It is A because two-way, because you have and organization with multiple accounts to manage and since you'd need to manage login's in a centralized manner, you'd need to have activated Identity Center and per the doc at https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html, with Identity Center, you have to have two-way trust.