ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Amazon Cognito and federated access / Question 1

DVA-C03 practice question: Amazon Cognito and federated access (1 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A fitness app for mobile devices lets members sign up and sign in with an email address and password.

After sign-in, the app must read and write the member's own folder in an Amazon S3 bucket, using temporary AWS credentials that cover only that folder. The app must not hold any AWS keys.

Which Amazon Cognito setup meets these requirements?

Choose one answer.

  1. A. A user pool only, with the app sending the user pool ID token to S3 with each request, so that S3 can check the member's folder.
  2. B. A user pool for sign-in, and an identity pool that exchanges the tokens for temporary credentials of a role limited to the member's folder.
  3. C. An identity pool only, with members signing up directly in the identity pool using their email address and password, and getting credentials at once.
  4. D. A user pool with an app client secret built into the app, and that secret used to sign every S3 request made on the member's behalf.
Show the answer and explanation

Answer: B

  • A. Wrong: S3 does not accept Cognito tokens. AWS service calls must be signed with AWS credentials, and a user pool alone does not provide those.
  • B. Right: Correct. The user pool authenticates the member and issues tokens. The identity pool trades those tokens for temporary AWS credentials, using a role whose policy covers only that member's folder. Learn more: Amazon Cognito identity pools (opens in a new tab)
  • C. Wrong: Identity pools do not hold a user directory or handle sign-up. They trust identities from providers such as user pools and issue AWS credentials for them.
  • D. Wrong: An app client secret authenticates the app to the user pool. It is not an AWS credential, and it must not be built into a mobile app.

Explanation

User pools answer who the user is by authenticating them and issuing tokens. Identity pools answer what AWS resources the user may use, by exchanging a trusted token for temporary credentials with a limited role. Apps that call AWS services directly usually combine the two.

Cognito user pool sign-in, then identity pool credentials for S3 The mobile app, which holds no AWS keys, signs the user in with a Cognito user pool and gets an ID token. A Cognito identity pool exchanges the token for temporary credentials of an IAM role. The role allows access only to the user's own prefix in the S3 bucket. Mobile app no AWS keys email and password Cognito user pool sign-in checks the password, returns an ID token Identity pool token exchange trades the token for temporary credentials S3 bucket user's own prefix role allows only this user's prefix
The user pool says who the member is. The identity pool turns that into short-lived credentials for one folder.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Amazon Cognito and federated accessAll Amazon Cognito and federated access questions

Want more on Amazon Cognito and federated access? The 5 full-length practice sets have 15 more Amazon Cognito and federated access questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets