ExpertMedium1 markMultiple Choice
AWS SAP-C02 · Question 17 · Domain 1.2: Security Controls
An enterprise uses AWS IAM Identity Center (AWS SSO) integrated with their on-premises Active Directory. Users are complaining that they cannot access a newly created AWS account within the organization. What is the MOST likely cause?
An enterprise uses AWS IAM Identity Center (AWS SSO) integrated with their on-premises Active Directory. Users are complaining that they cannot access a newly created AWS account within the organization. What is the MOST likely cause?
Answer options:
A.
The new account has not been joined to the on-premises Active Directory domain.
B.
Permission sets have not been provisioned to the new account for the relevant AD groups.
C.
An SCP is blocking the sts:AssumeRoleWithSAML action in the new account.
D.
The Active Directory Connector needs to be restarted to sync the new account.
How to approach this question
Understand how IAM Identity Center grants access: Users/Groups + Permission Sets + Target Accounts.
Full Answer
B.Permission sets have not been provisioned to the new account for the relevant AD groups.✓ Correct
Permission sets have not been provisioned to the new account for the relevant AD groups.
Access in IAM Identity Center is granted by creating assignments, which map a User or Group to a Permission Set in a specific AWS Account.
Common mistakes
Assuming access is automatic when an account is created in Organizations.
Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 1
75 questions · hints · full answers · grading
More questions from this exam
Q01An enterprise has 50 VPCs across two AWS Regions. They need to establish transitive routing betwe...HardQ02A company uses AWS Organizations. The security team wants to ensure that no IAM user or role can ...MediumQ03An application requires a relational database with an RPO of 1 second and an RTO of less than 1 m...HardQ04A company is setting up a new multi-account environment. They want to automate the provisioning o...MediumQ05An organization wants to allocate AWS costs to specific business units. They use AWS Organization...Hard