AWS Certified Security – Specialty (SCS-C02) — Question 36

A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message when trying to log in:
Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)
A security engineer needs to provide a solution that corrects the error and minimizes operational overhead.
Which solution meets these requirements?

Answer options

• A. Upload the third-party signing certificate’s new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.
• B. Sign the identity provider's metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
• C. Download the updated SAML metadata file from the identity service provider. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
• D. Configure the AWS identity provider entity defined in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.

Correct answer: C

Explanation

The correct answer is C because downloading the updated SAML metadata file and updating it in the AWS identity provider entity ensures that the new signing certificate is recognized for authentication. Options A and B are incorrect as they involve incorrect processes related to private keys and signatures instead of updating the metadata. Option D is misleading since it suggests synchronously fetching the key, which isn't the standard procedure for SAML metadata updates.