SCS-C03 practice question: Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) (2 of 2)

Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A state university research office runs analytics on sensitive student and grant data. Analysts sign in with IAM Identity Center. Today every analyst uses one shared IAM role to query the data, so the audit logs cannot show which person ran each query.

The office needs each query to run as the analyst's own identity, so that the same data-access rules apply to each person. Access should follow group membership in the university identity provider, and the office does not want to create IAM users or access keys.

Which TWO changes meet these requirements? (Choose two.)

Choose two answers.

A. Keep the shared role, and add an IAM policy condition that requires each caller to tag the query with the analyst user name. The audit logs will then show the name for every query that runs.
B. Create one IAM user and access key for each analyst in the research account, and have each analyst store the key in their analytics tool. Each query then runs under a separate user.
C. Enable trusted identity propagation for the IAM Identity Center instance, and configure the analytics applications to accept identity-enhanced sessions from it.
D. Assign the university data-access groups to the analytics applications in IAM Identity Center, so that each group's members can open those applications and the access follows the identity provider groups.
E. Move the sensitive data into a separate AWS account for each analyst, with its own copy of the data and an IAM role for that analyst. Each analyst then queries only their own copy of the data.

Show the answer and explanation

Answers: C, D

A. Wrong: Tags are set by the caller, so a user can enter any name, and the shared role still hides the real identity. The logs would show what the caller said, not a verified identity.
B. Wrong: Separate IAM users do give separate identities, but long-term access keys are hard to manage and rotate for many analysts. The office does not want IAM users or access keys, so this option breaks the requirement.
C. Right: Correct. Trusted identity propagation carries each analyst's identity into the analytics services, so queries and audit logs name the person. No IAM users or shared roles are needed for those sessions. Learn more: Trusted identity propagation overview (opens in a new tab)
D. Right: Correct. Group assignments in Identity Center mean that access follows the identity provider groups, and adding or removing a member changes access without new policies. Together with propagation, the access rules stay tied to each person.
E. Wrong: Separate accounts and copies isolate analysts, but they multiply storage and make shared grant data impractical. The copies would drift apart, which breaks the shared access rules the office needs.

Explanation

Trusted identity propagation keeps each analyst's identity attached to queries, and Identity Center application assignments control which groups from the identity provider can reach each application. The shared role, caller-set tags, per-user keys, and per-analyst copies each miss one requirement.

SCS-C03 practice question: Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) (2 of 2)

Explanation

Study

Keep practicing