SCS-C03 practice question: Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) (1 of 2)
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A consulting firm runs 40 AWS accounts for its clients and manages its employees in an external identity provider. Contractors join and leave projects every few weeks, and their access must end within one hour of removal from the identity provider.
The security team wants engineers to sign in through that identity provider, with no IAM users in any account. Access should be granted by job role across all accounts, and changes should be made in one place.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Configure SAML sign-in from the identity provider to IAM Identity Center. Create each user in Identity Center by hand, and assign each person's permission sets account by account.
BB. Configure SAML sign-in and SCIM provisioning from the identity provider to IAM Identity Center. Use a Lambda function to copy each group into an IAM role in every account, so that the roles follow the groups.
CC. Configure SAML sign-in and SCIM provisioning from the identity provider to IAM Identity Center. Assign permission sets to the identity provider groups for each account, so removing a user from a group removes access everywhere.
DD. Create an IAM SAML identity provider and one federated role in each account for each job function. Ask the identity provider admins to remove contractors from the role trust list when their projects end.
Show the answer and explanation
Answer: C
A. Wrong: SAML sign-in works, but manual user creation means a removed contractor keeps access until someone deletes the Identity Center user. Assigning permission sets one account at a time also multiplies the work across 40 accounts.
B. Wrong: Provisioning keeps users current, but copying groups into IAM roles adds custom code to maintain in 40 accounts. Roles created outside Identity Center sit outside its permission set model, so the team runs two access systems.
C. Right: Correct. SCIM removes deprovisioned contractors from Identity Center, and group-based permission set assignments apply across all accounts from one place. This meets the one-hour removal rule with no IAM users and no custom code. Learn more: Automatic provisioning in IAM Identity Center (opens in a new tab)
D. Wrong: Federation avoids IAM users, but the role trust must be edited in 40 accounts whenever a contractor leaves. Removal then depends on manual edits that can be late, which misses the one-hour requirement.
Explanation
IAM Identity Center can use an external identity provider for sign-in through SAML and keep users and groups current through SCIM. Group-based permission set assignments then give the right access across 40 accounts from one place. Manual users, copied roles, and per-account trust edits each fail a stated requirement.
Want more on Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service)? The 5 full-length practice sets have 6 more Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →