DOP-C02 practice question: Federation and IAM Identity Center (1 of 2)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital network uses its corporate identity provider, which supports SAML 2.0 and SCIM, for all staff sign-ins. Clinicians need console access to 40 AWS accounts, with different permissions in production and in the research accounts.
When a clinician joins or leaves a department, that person's access should be added or removed automatically, without an administrator working in each account. The hospital does not want any long-lived IAM users for clinicians.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Create an IAM user for each clinician in each account that needs access, with a console password that the clinician rotates every 90 days.
BB. Connect IAM Identity Center to the corporate provider over SAML, turn on SCIM provisioning, and assign directory groups to accounts with permission sets.
CC. Set up a separate SAML identity provider in each of the 40 accounts, and map each identity provider to a role that the department's administrator maintains.
DD. Share a single administrator account with all clinicians, and ask each department to record who is using it in a shared log for the audit team.
Show the answer and explanation
Answer: B
A. Wrong: IAM users in 40 accounts would need to be created and removed by hand, and they are long-lived credentials the hospital wants to avoid. The approach does not follow the corporate directory.
B. Right: Correct. Identity Center federates sign-ins from the corporate provider over SAML, SCIM provisions users and groups from the directory, and permission sets set the access in each account. No IAM users are created for clinicians. Learn more: Manage AWS accounts with permission sets (opens in a new tab)
C. Wrong: A separate identity provider and role mapping in each account multiplies the setup and upkeep. Each change would still need an administrator in every account.
D. Wrong: A shared account removes individual accountability and the directory-based access the hospital needs. A manual log is not an audit control that CloudTrail would provide.
Explanation
IAM Identity Center federates sign-ins from the corporate identity provider, SCIM keeps users and groups synchronized with the directory, and permission sets define access in each account. Clinicians need no IAM users, and joiners and leavers are handled centrally. Per-account users, per-account identity providers and shared accounts each add manual work or lose accountability.
Want more on Federation and IAM Identity Center? The 5 full-length practice sets have 9 more Federation and IAM Identity Center questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →