Exam AWS Certified Database - Specialty All Questions

View all questions & answers for the AWS Certified Database - Specialty exam

Exam AWS Certified Database - Specialty topic 1 question 62 discussion

Exam question from Amazon's AWS Certified Database - Specialty

Question #: 62
Topic #: 1

[All AWS Certified Database - Specialty Questions]

A company's Security department established new requirements that state internal users must connect to an existing Amazon RDS for SQL Server DB instance using their corporate Active Directory (AD) credentials. A Database Specialist must make the modifications needed to fulfill this requirement.
Which combination of actions should the Database Specialist take? (Choose three.)

A. Disable Transparent Data Encryption (TDE) on the RDS SQL Server DB instance.
B. Modify the RDS SQL Server DB instance to use the directory for Windows authentication. Create appropriate new logins.
C. Use the AWS Management Console to create an AWS Managed Microsoft AD. Create a trust relationship with the corporate AD.
D. Stop the RDS SQL Server DB instance, modify it to use the directory for Windows authentication, and start it again. Create appropriate new logins.
E. Use the AWS Management Console to create an AD Connector. Create a trust relationship with the corporate AD.
F. Configure the AWS Managed Microsoft AD domain controller Security Group.

Show Suggested Answer

Suggested Answer: BCF 🗳️

by Billhardy at Aug. 9, 2020, 10:18 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

manan728

Highly Voted 3 years, 8 months ago

This question was asked in my exam. B,C and F seems the correct options.

upvoted 6 times

...

IhorK

Most Recent 1 year, 11 months ago

C. ...to create an AWS Managed Microsoft AD. Create a trust relationship... E. ... to create an AD Connector. Create a trust relationship... Both option are correct. We should use AWS Managed Microsoft AD when have > 5000 users. We should use AD Connector or Simple AD when have < 5000 users. The question is not complete, or one of these answers should be excluded. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ad_connector_best_practices.html

upvoted 2 times

...

adelcold

2 years ago

Selected Answer: BCF

https://aws.amazon.com/blogs/security/how-to-enable-windows-integrated-authentication-for-rds-for-sql-server-using-on-premises-active-directory/#:~:text=The%20setup%201%20Step%201%3A%20Set%20up%20RDS,between%20your%20VPC%20domain%20and%20your%20on-premises%20domain

upvoted 1 times

...

ninjalight25

2 years, 4 months ago

Selected Answer: BCD

To fulfill the Security department's requirement for internal users to connect to the Amazon RDS for SQL Server DB instance using their corporate Active Directory credentials

upvoted 1 times

Mintwater

2 years, 3 months ago

D and B are conflicted, and B is the correct sequence -- modify the instance while the instance is up, let it connect to the AWS AD, then reboot the instance to make the connection valid. D -- Once you stopped the instance, you could not modify it.

upvoted 1 times

Mintwater

2 years, 3 months ago

BCF is the answer

upvoted 1 times

...

ryuhei

3 years ago

Selected Answer: BCF

Answer:BCF

upvoted 1 times

...

novice_expert

3 years, 2 months ago

Selected Answer: BCF

x A. Disable Transparent Data Encryption (unrelated) B. Modify the RDS SQL Server DB instance to use the directory for Windows authentication. Create appropriate new logins.(would need reboot) C. Use the AWS Management Console to create an AWS Managed Microsoft AD. Create a trust relationship with the corporate AD. x D. Stop the RDS SQL Server DB instance, modify it to use the directory for Windows authentication, and start it again. Create appropriate new logins. (stop-start should be at end, not first) x E. Use the AWS Management Console to create an AD Connector. Create a trust relationship with the corporate AD. F. Configure the AWS Managed Microsoft AD domain controller Security Group.

upvoted 4 times

...

guru_ji

3 years, 8 months ago

I got this Question in exam.

upvoted 1 times

...

myutran

3 years, 8 months ago

Ans: BCF

upvoted 2 times

...

JobinAkaJoe

3 years, 8 months ago

BCF C&F is confirmed. Choosing B over D because modifying the RDS to enable windows authentication must be done when the RDS is in available status though it will be rebooted for it to take effect.

upvoted 4 times

...

[Removed]

3 years, 8 months ago

BCF is the answer - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_SQLServerWinAuth.html

upvoted 3 times

...

Ashoks

3 years, 8 months ago

BCF. No restart required. Connector is a proxy, no trust relationship can be established with it.

upvoted 4 times

...

Manmohan

3 years, 8 months ago

Ans: BEF

upvoted 1 times

anon9002

3 years, 8 months ago

E - Not right https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ad_connector_app_compatibility.html

upvoted 2 times

...

Jack86

3 years, 9 months ago

Sorry i made a mistake. According to https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html#USER_ModifyInstance.Settings , modifying domain or directory id parameter in AWS RDS SqlServer requires a bried outage . So correct answers are : C , D , F .

upvoted 4 times

...

Jack86

3 years, 9 months ago

I would also vote for BCF. Nobody doubt that C anf F are correct. Regarding my choice B ( B or D ? ). We need to configure an existing DB ( stated in the question). According to https://aws.amazon.com/blogs/database/joining-your-amazon-rds-instances-across-accounts-to-a-single-shared-domain/ , there is no need to stop the RDS to join it to an AD ( step 3 )

upvoted 4 times

...

AWSCert2020

3 years, 9 months ago

CDF Here https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_SQLServerWinAuth.html

upvoted 3 times

...

Ebi

3 years, 9 months ago

Answer is BDE

upvoted 1 times

Ebi

3 years, 9 months ago

Meant BCF D is not correct, you can't modify stopped RDS instance

upvoted 8 times

saki0915

3 years, 9 months ago

Isn't B not restarting RDS?

upvoted 1 times

...

anon9002

3 years, 8 months ago

E - Not right https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ad_connector_app_compatibility.html

upvoted 1 times

Mintwater

2 years, 3 months ago

Note Amazon RDS is compatible with AWS Managed Microsoft AD only, and is not compatible with AD Connector. For more information, see the AWS Microsoft AD section in the AWS Directory Service FAQs page.

upvoted 2 times

...

Billhardy

3 years, 9 months ago

I will go with CDF https://www.powerupcloud.com/integrate-aws-sql-server-rds-with-multiple-ad/ https://www.sqlshack.com/advanced-windows-authentication-configurations-in-aws-rds-sql-server/ https://aws.amazon.com/blogs/security/how-to-enable-windows-integrated-authentication-for-rds-for-sql-server-using-on-premises-active-directory/ https://aws.amazon.com/blogs/aws/amazon-rds-for-sql-server-support-for-windows-authentication/

upvoted 3 times

...