ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Integrating the HR-backed identity platform with AWS IAM Identity Center (formerly AWS SSO) by using the System for Cross-Domain Identity Management (SCIM) protocol off-loads the entire provisioning and de-provisioning workflow to the managed service. When the HR system flags that a contractor's employment has ended, the SCIM connector automatically removes the corresponding user and group assignments in IAM Identity Center, which in turn revokes console sign-in and invalidates any associated AWS credentials-without requiring custom code or manual reviews.

Scheduling a Lambda function to parse credential reports still leaves the organization responsible for writing and maintaining custom logic, increasing operational overhead. Automatic key rotation merely ages out access keys but leaves console passwords and active sessions untouched. Service control policies apply at the AWS Organizations level and do not delete or disable individual IAM principals; they would also require administrative updates for each departing contractor. Therefore, leveraging SCIM-based provisioning in IAM Identity Center is the most effective and least operationally intensive solution.