SAP-C02 Practice Question 50: Directory Dependent App Migration

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 5 · question 10 of 10

Migration and Modernizationeasy

A utility is migrating a suite of .NET and SQL Server applications to Amazon EC2. The applications authenticate users with Kerberos and read group membership from the company's on-premises Microsoft Active Directory, and the EC2 instances must be domain-joined so that the applications keep working unchanged.

The identity team insists that user accounts stay in the on-premises directory, which remains the authoritative source. The infrastructure team has two further constraints: authentication for the AWS-hosted applications must keep working if the AWS Direct Connect link to the data centre is down for several hours, and nobody wants to patch or monitor domain controllers running on EC2.

What should the solutions architect recommend?

Show answer and explanation

Answer:

C. Deploy AWS Managed Microsoft AD in two Availability Zones, establish a trust with the on-premises Active Directory, and domain-join the application servers to the AWS directory

AWS Managed Microsoft AD runs actual Microsoft Active Directory as a managed service, creating a highly available pair of domain controllers across different Availability Zones in the VPC, with AWS handling host monitoring, recovery, replication, snapshots, and software updates, which satisfies the "nobody patches domain controllers" constraint. It is the option AWS recommends for running directory-aware workloads such as custom .NET and SQL Server based applications. The trust relationship is what keeps the on-premises directory authoritative: the AWS directory acts as a resource forest for the AWS-hosted resources while user identities stay in the existing domains, and users reach AWS resources with their existing credentials. Because the domain controllers for the resource forest live in the VPC, domain-joined instances authenticate locally and keep working while the Direct Connect link is down.

Option A produces the right authentication behaviour but is entirely self-managed. The utility now owns patching, monitoring, backup, and replication of two domain controllers on EC2, the operational burden the infrastructure team explicitly rejected.

Option B is a proxy, not a directory. AD Connector forwards every authentication request to the on-premises domain controllers, so an outage of the Direct Connect link stops authentication for the AWS-hosted applications, which fails the stated constraint directly.

Option D is a Samba-based directory that does not support trust relationships with an existing Active Directory, so the on-premises directory cannot remain authoritative, and it lacks the schema and features that .NET and SQL Server workloads expect.

Reference: AWS Managed Microsoft AD

Practice Test 5 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.