Troubleshooting sign-in and authentication: SCS-C03 study notes and practice questions
What to know about Troubleshooting sign-in and authentication for the SCS-C03 exam, from the Identity and Access Management domain (20% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a sign-in that suddenly fails for one user, for a group, or for everyone, and ask for the cause or the next step. Some also describe a suspicious pattern of failed logins. The skill is to match the symptom to the layer that fails, then choose the smallest fix that keeps the account secure.
The facts that decide answers
Identity Center users cannot sign in when SCIM has not provisioned them, when they are not assigned to the account with a permission set, or when the external IdP’s SAML certificate or metadata has changed. An expired IdP signing certificate breaks sign-in for every user at once.
SAML assertions have short validity windows, so clock differences between systems can cause failures that look random.
MFA problems come from a lost device or a device that was never registered. Identity Center administrators can reset a user’s registered MFA devices after verifying the person.
IAM users sign in at the account sign-in page with the account ID or alias. The root user signs in with root credentials and is a separate path. Keep root out of day-to-day troubleshooting.
CloudTrail records console sign-ins as ConsoleLogin events. A failed attempt shows an error message such as a failed authentication, and the event data shows whether MFA was used.
Containment comes first for a suspected compromise: disable the user in the identity source or in Identity Center, then review CloudTrail for what the user did.
An EventBridge rule on root sign-in events gives an early alert for the highest-risk path.
How to choose
Scenario wording
Pick
A new user cannot sign in after SCIM was set up
Check provisioning status and group assignment in Identity Center
Sign-in fails for everyone after an IdP change
Check the IdP’s SAML certificate and metadata against Identity Center
Assertion or timing errors
Check time synchronization in the identity source
Repeated failed console sign-ins for one user
Query CloudTrail ConsoleLogin events, then check MFA status
User lost an MFA device
Administrator resets the device after identity verification
Suspected compromised account
Disable sign-in in the identity source, then review CloudTrail
Common traps
Changing the permission set when the real cause is a missing group assignment.
Creating an IAM user as a quick workaround during an Identity Center problem, and leaving it in place afterward.
Using root credentials or resetting root MFA to fix a workforce sign-in problem.
Skipping CloudTrail when investigating failed sign-ins, and checking only the user’s own report.
Disabling the user’s access keys when the problem is in the identity source, so the fix does not hold.
A university uses its campus identity provider for single sign-on into AWS accounts. The identity provider sends SAML assertions to a SAML identity provider in IAM, and each assertion carries a role attribute for the user.
Since a recent change, some staff see an error that the SAML audience restriction failed. Others sign in successfully but see no roles to choose from. Every staff member must be able to sign in, and the team must not give anyone broader access to fix the problem.
Which TWO checks should the security engineer make first? (Choose two.)
Choose two answers.
AA. Confirm that the Audience value in the assertion is https://signin.aws.amazon.com/saml, which is the value the IAM SAML identity provider expects.
BB. Raise the maximum session duration of every role to 12 hours, so that sessions do not expire while the user is still signing in to the console.
CC. Create a second SAML identity provider in IAM from the same metadata file, and point half of the staff to it. Users who fail on the first provider will then sign in through the second provider instead.
DD. Confirm that each Role attribute value pairs a role ARN with a SAML provider ARN, and that the role trust policy lists that same SAML provider as a trusted principal.
EE. Add every affected user to an IAM group with the AdministratorAccess policy until the sign-in problem is fixed, and then remove the group from each user once the problem is resolved.
Show the answer and explanation
Answers: A, D
A. Right: Correct. The audience restriction in the assertion must match the value that AWS expects, and any other value fails with an audience error. Checking this value in the identity provider SAML settings addresses the first reported error directly. Learn more: Using SAML-based federation for IAM roles (opens in a new tab)
B. Wrong: Session duration controls how long a session lasts after sign-in succeeds, not whether the assertion is accepted. Raising it would not fix an audience error or an empty role list, and it would widen exposure for every user.
C. Wrong: A second provider created from the same metadata has the same audience and role mapping, so the same users fail on either one. Splitting staff between providers adds confusion without fixing the cause.
D. Right: Correct. Each role value must name one role and its matching SAML provider in a comma-separated pair, and the role must trust that provider. A malformed or mismatched value leaves a user with no roles to choose from.
E. Wrong: This is a workaround that gives broad access, which the requirement forbids. It also does not identify the cause, so the sign-in error would return as soon as the group is removed.
Explanation
A SAML sign-in fails when the audience in the assertion does not match the IAM SAML provider, or when the role attribute does not pair a role with a provider the role trusts. Checking those two values addresses both reported symptoms. Session length, a duplicate provider, and broad temporary access do not fix either cause.
Want more on Troubleshooting sign-in and authentication? The 5 full-length practice sets have 6 more Troubleshooting sign-in and authentication questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →