Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An application needs to assume an IAM role in another AWS account to access resources. Which AWS STS API call is used to obtain temporary credentials for this purpose?

   • AAssumeRole
   • BGetSessionToken
   • CAssumeRoleWithSAML
   • DGetFederationToken
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A user assigned to an AWS account through IAM Identity Center is unable to access a specific S3 bucket, even though the permission set includes the required policy. What is a likely cause of this issue?

   • AThe user's IAM user account is disabled
   • BThe S3 bucket is in a different Region
   • CThe user's password is expired
   • DThe permission set is not attached to the user's group
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A developer is troubleshooting why users cannot sign in to an application that uses Amazon Cognito user pools. Which AWS service can be used to view logs of the authentication requests?

   • AAWS X-Ray
   • BAWS CloudTrail
   • CAmazon CloudWatch Logs
   • DAWS Config
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An application is trying to authenticate to AWS Managed Microsoft AD using LDAP, but the authentication is failing. Which of the following is a common cause of LDAP authentication failures?

   • AThe LDAP port is not open in the security group
   • BIncorrect LDAP bind credentials
   • CThe application is using a non-SSL connection
   • DThe directory is not in the same VPC
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company uses AWS Managed Microsoft AD for authentication for both EC2 instances and AWS services. Recently, EC2 instances that were domain-joined are failing to authenticate with Kerberos, while AWS services that use the directory continue to work. The directory's health status is healthy. What should the administrator investigate first?

   • AConfirm that the directory's service account has the correct permissions to authenticate EC2 instances.
   • BCheck the CloudTrail log for the directory to see if there are any authentication failures.
   • CCheck the security group rules for the EC2 instances to ensure they allow outbound traffic to the directory on port 88 (Kerberos).
   • DVerify that the directory's DNS settings are correctly configured to resolve the EC2 instances' hostnames.
   Reveal Solution Discussion Select an answer first