The correct answer is Join the file system to the Active Directory to restrict access.

Amazon FSx for Windows File Server supports seamless integration with Microsoft Active Directory, including on-premises AD via AWS Directory Service or AD Connector. By joining the FSx file system to the existing Active Directory domain, the company can continue using AD groups and permissions to control access to SMB sharesjust as they do on-premises. This ensures a consistent security model with minimal changes to existing group-based access controls.

Create an Active Directory Connector to connect to the Active Directory. Map the Active Directory groups to IAM groups to restrict access is incorrect because IAM is not used for file-level access control in FSx for Windows File Server. Access is controlled via Windows ACLs and AD, not IAM.

Assign a tag with a Restrict tag key and a Compliance tag value. Map the Active Directory groups to IAM groups to restrict access is incorrect. Tags can be used for identifying or classifying resources but do not enforce access controls at the file or folder level.

Create an IAM service-linked role that is linked directly to FSx for Windows File Server to restrict access is also incorrect. Service-linked roles are used to allow AWS services to perform actions on behalf of the customer, not for user-level access control or permission enforcement.

Why this question matters: It tests your ability to design hybrid identity and access control solutions. Understanding how FSx for Windows integrates with existing Active Directory environments is essential when migrating on-premises Windows-based workloads to AWS.

Tip: FSx for Windows File Server integrates natively with Active Directory for user authentication and access control. Always join it to the correct AD domaineither AWS Managed AD or an on-prem AD via AD Connectorto preserve group-based access control.

Full AWS Practitioner Certification Question