Choosing a Managed Directory and Admin Endpoint for EC2 Domain Join

SAP-C02 By islever Editorial Last updated

Determine security controls based on requirements. Prescribe security controls.

Short answer

A Deploy AWS Managed Microsoft AD and use an Amazon WorkSpaces desktop as the managed, MFA-capable administrative endpoint for domain security configuration.

Question

A company is rearchitecting its applications to run on AWS. The company’s infrastructure includes multiple Amazon EC2 instances. The company's development team needs different levels of access. The company wants to implement a policy that requires all Windows EC2 instances to be joined to an Active Directory domain on AWS. The company also wants to implement enhanced security processes such as multi-factor authentication (MFA). The company wants to use managed AWS services wherever possible.
Which solution will meet these requirements?
  1. Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an Amazon Workspace. Connect to and use the Workspace for domain security configuration tasks. Correct Answer
  2. Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.
  3. Create an AWS Directory Service Simple AD implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.
  4. Create an AWS Directory Service Simple AD implementation. Launch an Amazon Workspace. Connect to and use the Workspace for domain security configuration tasks.

Key Takeaways

The question tests whether Simple AD can support MFA (it cannot) and whether "use managed AWS services wherever possible" pushes the admin workstation from EC2 to WorkSpaces.

This SAP-C02 scenario tests AWS Directory Service selection and administrative access design: AWS Managed Microsoft AD combined with Amazon WorkSpaces (option A) satisfies EC2 domain join, MFA support, and the managed-services preference.

Common mistake: Option B is the most tempting wrong answer: it correctly picks AWS Managed Microsoft AD but substitutes a self-managed EC2 admin instance, ignoring the explicit managed-services preference and the fact that RADIUS MFA does not cover EC2 sign-ins.

Expert Analysis

The qualifiers that decide this question The stem stacks three tests in a fixed order: (1) Windows EC2 instances must be domain-joined to an Active Directory domain on AWS; (2) enhanced security processes "such as multi-factor authentication" must be possible; (3) the company wants managed AWS services "wherever possible." Every option must pass all three, and the last qualifier is the tiebreaker.

Why options C and D are eliminated first Simple AD (Samba-based) cannot deliver requirement 2. It does not support RADIUS-based MFA integration, and it lacks the feature depth (fine-grained policies, MFA hooks) that "enhanced security processes" implies. Both C and D die on the directory choice alone, before the administration-workstation question is even reached.

The real fork: option A vs option B Both A and B correctly choose AWS Managed Microsoft AD (Directory Service for Microsoft Active Directory), which supports EC2 domain join and RADIUS MFA. The difference is the administrative endpoint: a managed Amazon WorkSpaces desktop (A) versus a self-managed EC2 instance (B). The phrase "wherever possible" is a preference, not an absolute — so option B must be clearly superior to win, and it is not. WorkSpaces is a fully managed service with native MFA at sign-in for the directory, and the AWS guidance for enabling MFA with Microsoft AD is explicitly demonstrated against WorkSpaces and QuickSight, not against EC2 RADIUS logins. AWS documentation further notes that RADIUS MFA does not provide MFA for Windows workloads running on EC2 or for signing into an EC2 instance, which weakens option B's security story.

The WorkSpaces-scale counterargument Community reasoning raises that AWS recommends against relying on a WorkSpace for directory administration beyond roughly five WorkSpaces. That caveat concerns directory administration scale at large deployments; this question specifies no user count or fleet size, so nothing in the wording triggers it. Absent a scale constraint, "wherever possible" points to the managed service, making option A the correct choice.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Attack the option pairs: with two directory choices and two admin endpoints, eliminate on the capability that only one directory supports (Simple AD has no RADIUS MFA), then apply the wording qualifier. Treat "wherever possible" as a soft but decisive preference — an alternative only wins if it is clearly superior on requirements, not on hypothetical scale the stem never states.

Frequently Asked Questions

Why can't Simple AD be used when MFA is required?

Simple AD is a Samba-based directory that lacks RADIUS/MFA integration and advanced policy features. AWS Managed Microsoft AD is required to integrate with RADIUS-based MFA providers for directory services.

Why is Amazon WorkSpaces preferred over an EC2 instance for administration here?

The question requires managed AWS services wherever possible. WorkSpaces is a managed desktop with MFA at sign-in, while an EC2 admin instance is self-managed and RADIUS MFA does not cover EC2 sign-ins.

When would an EC2-based admin host be the better choice?

When the directory supports many WorkSpaces — AWS advises against using a WorkSpace for administration at larger scale — or when custom tooling, domain controllers, or Group Policy management must be installed on a bastion host.

More SAP-C02 FAQ →

Community Votes

A
75%
B
15%
C
10%

75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 48 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 48

  1. HappyPrince 👍 13 Answered B
    I support B as well per this link where EC2 is recommended: https://docs.aws.amazon.com/workspaces/latest/adminguide/directory_administration.html
  2. nublit 👍 12 Answered B
    B is correct. The question mention "Windows EC2", no "Windows user desktops". Maybe the Windows EC2 can be Windows Servers.
  3. TonytheTiger 👍 5 Answered A
    Option A - Three requirements, 1. join AD domain, 2. enable MFA, 3. Use AWS managed service. Nothing about cost or any additional requirements. Option A checks all the boxes from the article information - https://aws.amazon.com/blogs/security/how-to-enable-multi-factor-authentication-for-amazon-workspaces-and-amazon-quicksight-by-using-microsoft-ad-and-on-premises-credentials/
  4. knark446 👍 5 Answered B
    I would vote B, it doesn't say anywhere that the windows ec2 instances are "user desktops", if that was the case A for sure.
  5. tiagobs 👍 4
    I did the same thing and asked to GPT why B is wrong, this is the answer. . . I apologize for any confusion. Upon closer examination, I realize that I made an error in my response. I appreciate your patience. Let's reevaluate the options: Option A is incorrect because Amazon Workspaces is a managed, secure cloud desktop service, but it is not the appropriate service for domain security configuration tasks. Workspaces is more suited for providing a cloud-based desktop experience to end-users. The correct option for the given requirements is: B. Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.
Show 25 more comments
  1. 07c2d2a 👍 3
    "The company wants to implement a policy that requires all Windows EC2 instances to be joined to an Active Directory domain on AWS". Workspaces are automatically domain joined. EC2 aren't going to be automatically domain joined without some extra steps. I feel like that's what they're getting at here...
  2. chelbsik 👍 3 Answered A
    A seems better, as it uses managed Workspaces, which we can apply different security controls to despite what some people here say https://docs.aws.amazon.com/whitepapers/latest/best-practices-deploying-amazon-workspaces/security.html
  3. dankositzke 👍 3 Answered A
    I would choose A over B because of the last requirement: “The company wants to use managed AWS services wherever possible.”
  4. trungtd 👍 3 Answered A
    Technically, you can use AWS Workspace for domain security configuration tasks. So A is correct
  5. aka1177 👍 3 Answered A
    I would say A is the answer - since all services are AWS managed (requirement)
  6. savytech 👍 3 Answered A
    answer is A as he said in the q to use managed service whenever possible
  7. Jay_2pt0_1 👍 3
    What in the vague is this? I'm not sure.
  8. career360guru 👍 3 Answered A
    Option A
  9. kyo 👍 2 Answered A
    The question does mention EC2 specifically, which makes the WorkSpaces solution a little less direct. However, the requirement to use managed AWS services "wherever possible" strongly suggests WorkSpaces for MFA. It's the most managed way to get that done. So, while EC2 is mentioned, the emphasis on managed services and the need for MFA makes WorkSpaces the most likely answer. It's a trade-off, but the question is probably prioritizing managed services over strict adherence to only using EC2 for everything.
  10. chelbsik 👍 2
    Additionally, you can apply Group Policies to Windows Workspaces, which is a domain security task, though there are some limitations https://docs.aws.amazon.com/workspaces/latest/adminguide/group_policy.html
  11. shaaam80 👍 2 Answered A
    GPT - Launch an Amazon Workspace, which is a fully managed, secure desktop-as-a-service (DaaS) solution. Use the Workspace for domain security configuration tasks. Answer A
  12. chelbsik 👍 2
    This just means you shouldn't blindly trust ChatGPT, it likes to change shoes while walking all the time
  13. dspd 👍 2 Answered A
    Its A managed
  14. devalenzuela86 👍 2 Answered B
    B is correct
  15. Al8282 👍 1 Answered A
    This is so tough. The docs state if youre using more than 5 workspaces its better to manage security through a centralized EC2 instance which leads towards B. The question makes no claims of how big the environment is but it eludes to it being small by saying 'A workspace' which would mean just 1 user since its scoped to user. Nothing in the question highlights more than 5 or large teams either. It explicitly states managed services wherever possible. The workspace meets all of the technical requirements. It just doesnt scale well but the overhead for cost is minimal for a large organization, just a few dollars a workspace a month. Im going to assume if it was very large they would tell us and not pick 'a workspace' but rather say 'workspaces'. Going with A. Really tough one with the ambiguity.
  16. 0b43291 👍 1 Answered A
    Option A meets the requirements by using AWS Directory Service for Microsoft Active Directory, a managed service for hosting a full Active Directory domain. It also leverages Amazon WorkSpaces, a managed desktop service supporting MFA, for secure administrative access to configure the Active Directory domain, aligning with the company's preference for managed AWS services. Option B: While creating an AWS Directory Service for Microsoft Active Directory implementation is correct, launching an EC2 instance for domain security configuration tasks is not the most suitable approach. EC2 instances require additional management overhead, and the company wants to use managed services wherever possible.
  17. Curious76 👍 1 Answered B
    I correct my answer after more searches It aligns with AWS best practices for centralized, robust AD administration using an Amazon EC2 instance. Why A (WorkSpaces) is not the best: Even though it's possible to install AD tools on a WorkSpace, AWS recommends against it for anything beyond minimal scale (5+ WorkSpaces). It’s less robust than using a dedicated EC2 instance. Choose Option B because: It uses AWS Managed Microsoft AD (required for MFA and full AD support). It aligns with AWS best practices for centralized, robust AD administration using an Amazon EC2 instance.
  18. AzureDP900 👍 1
    B is right The company wants to join all Windows EC2 instances to an Active Directory domain on AWS, which requires a full-featured Active Directory service. Using AWS Directory Service for Microsoft Active Directory (Enterprise edition) meets this requirement by providing a managed directory service that can be used to manage and secure EC2 instances. Launching an EC2 instance allows the development team to configure and test domain security configurations in a controlled environment, which is essential for ensuring the correct configuration of the Active Directory
  19. junehc 👍 1
    I will go for A based on this "RADIUS MFA is applicable only to authenticate access to the AWS Management Console, or to Amazon Enterprise applications and services such as WorkSpaces, Amazon QuickSight, or Amazon Chime. It does not provide MFA to Windows workloads running on EC2 instances, or for signing into an EC2 instance" https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ad_connector_mfa.html
  20. Daniel76 👍 1 Answered B
    Add a vote to B as it is dangerously swaying to A. The EC2 instances referred to should be the managed domain controller to manage EC2 instances that join the domain, to push down GPO policies etc. You can launch more than one for HA. https://aws.amazon.com/blogs/security/how-to-increase-the-redundancy-and-performance-of-your-aws-directory-service-for-microsoft-ad-directory-by-adding-domain-controllers/
  21. FZA24 👍 1 Answered A
    The company wants to use managed AWS services wherever possible. https://docs.aws.amazon.com/workspaces/latest/adminguide/directory_administration.html You'll perform most administrative tasks for your WorkSpaces directory using directory management tools, such as the Active Directory Administration Tools. However, you'll use the WorkSpaces console to perform some directory-related tasks.
  22. Al8282 👍 1 Answered A
    Going with A. The company wants to use managed AWS services wherever possible, its explicitly stated. The scope of tasks is well defined and small. I suspect the recommendation is for larger deployments it wouldn't have said 'for MFA' and highlight such lightweight services. https://docs.aws.amazon.com/workspaces/latest/adminguide/directory_administration.html
  23. EzKkk 👍 1
    The problem with most of AWS certificate question is its ambiguity. The question is constructed using hints with only one correct answer, not real life study. So, if the question hints that you have a checklist of requirement, you should only care about ticking all the box, not the correctness of the solution really. Learned the hard way :)
  24. sashenka 👍 1 Answered A
    Answer is A: Amazon WorkSpaces is a managed desktop-as-a-service solution that aligns with the requirement to use managed services: - Provides a managed alternative to running EC2 instances - Integrates seamlessly with AWS Managed Microsoft AD. - Reduces administrative overhead compared to managing EC2 instances
  25. Soliner_Bilgi_Teknolojileri 👍 1 Answered A
    AWS Managed Microsoft AD provides full Active Directory features for domain-joining Windows EC2 instances, and WorkSpaces allows secure, managed access with MFA without exposing EC2 directly. This meets all requirements using managed services.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide