Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A municipal utility enterprise is deploying a new smart-metering application on AWS that must integrate with their existing on-premises Microsoft Active Directory. The enterprise plans to run Active Directory-aware application servers on Amazon EC2 instances in a VPC. The application must authenticate corporate users and domain-join the EC2 instances. The enterprise wants to minimize operational overhead, prevent any replication of Active Directory data to the cloud, and avoid setting up a trust relationship. Which solution meets these requirements with the least operational complexity?

  1. A
    Deploy AWS Managed Microsoft AD in the VPC, and establish a two-way forest trust relationship with the on-premises Microsoft Active Directory.
  2. Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.Answer
  3. C
    Create individual IAM users in the AWS account for all corporate users, and configure a custom synchronization server on EC2 to replicate user credentials from the on-premises Active Directory.
  4. D
    Use the AWS account root user to generate a single set of long-term access keys, and hardcode these credentials in the application configuration to authenticate all incoming user requests.

Answer

Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.
Using AWS Directory Service AD Connector meets all the requirements. AD Connector is a directory gateway that redirects directory requests to the on-premises Active Directory without caching or replicating any data in the cloud, and it does not require establishing a trust relationship. This minimizes operational complexity while satisfying the domain-join and user authentication needs.

Step-by-Step Solution

1
Analyze the requirements for Active Directory integration on AWS EC2 instances.
The requirements demand domain-joining EC2 instances and authenticating users using on-premises Microsoft Active Directory credentials without establishing trust relationships or replicating directory data.
This narrows down the Directory Service options to those that function as a proxy or directory gateway.
2
Evaluate the capabilities of AD Connector versus AWS Managed Microsoft AD.
AWS Managed Microsoft AD requires establishing a trust relationship and replicates directory records, whereas AD Connector acts as a pure directory gateway (proxy) redirecting requests to the on-premises Active Directory without caching or trust requirements.
This aligns with the enterprise's goal of avoiding data replication and trust relationships while minimizing operational overhead.
3
Select the option that configures AD Connector to domain-join instances and authenticate users.
The correct option is identified as using AWS Directory Service AD Connector.
It fulfills all technical and business constraints with the lowest operational complexity.

Key Concept

AWS Directory Service AD Connector serves as a directory gateway to redirect requests to an on-premises Active Directory without caching data or requiring trust relationships.
Estimated Time:2m 0s
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic