SCS-C03 practice question: Troubleshooting sign-in and authentication
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A university uses its campus identity provider for single sign-on into AWS accounts. The identity provider sends SAML assertions to a SAML identity provider in IAM, and each assertion carries a role attribute for the user.
Since a recent change, some staff see an error that the SAML audience restriction failed. Others sign in successfully but see no roles to choose from. Every staff member must be able to sign in, and the team must not give anyone broader access to fix the problem.
Which TWO checks should the security engineer make first? (Choose two.)
Choose two answers.
AA. Confirm that the Audience value in the assertion is https://signin.aws.amazon.com/saml, which is the value the IAM SAML identity provider expects.
BB. Raise the maximum session duration of every role to 12 hours, so that sessions do not expire while the user is still signing in to the console.
CC. Create a second SAML identity provider in IAM from the same metadata file, and point half of the staff to it. Users who fail on the first provider will then sign in through the second provider instead.
DD. Confirm that each Role attribute value pairs a role ARN with a SAML provider ARN, and that the role trust policy lists that same SAML provider as a trusted principal.
EE. Add every affected user to an IAM group with the AdministratorAccess policy until the sign-in problem is fixed, and then remove the group from each user once the problem is resolved.
Show the answer and explanation
Answers: A, D
A. Right: Correct. The audience restriction in the assertion must match the value that AWS expects, and any other value fails with an audience error. Checking this value in the identity provider SAML settings addresses the first reported error directly. Learn more: Using SAML-based federation for IAM roles (opens in a new tab)
B. Wrong: Session duration controls how long a session lasts after sign-in succeeds, not whether the assertion is accepted. Raising it would not fix an audience error or an empty role list, and it would widen exposure for every user.
C. Wrong: A second provider created from the same metadata has the same audience and role mapping, so the same users fail on either one. Splitting staff between providers adds confusion without fixing the cause.
D. Right: Correct. Each role value must name one role and its matching SAML provider in a comma-separated pair, and the role must trust that provider. A malformed or mismatched value leaves a user with no roles to choose from.
E. Wrong: This is a workaround that gives broad access, which the requirement forbids. It also does not identify the cause, so the sign-in error would return as soon as the group is removed.
Explanation
A SAML sign-in fails when the audience in the assertion does not match the IAM SAML provider, or when the role attribute does not pair a role with a provider the role trusts. Checking those two values addresses both reported symptoms. Session length, a duplicate provider, and broad temporary access do not fix either cause.
Want more on Troubleshooting sign-in and authentication? The 5 full-length practice sets have 6 more Troubleshooting sign-in and authentication questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →