Exams / DVA-C02 / Amazon Cognito and federated access / Question 1
DVA-C02 practice question: Amazon Cognito and federated access (1 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A developer is building a mobile app where users sign up and sign in with an email address and password. After signing in, the app must upload files directly to an Amazon S3 bucket using temporary AWS credentials scoped to that user. Which Amazon Cognito setup meets these requirements?
Choose one answer.
- AA. A user pool only, with the app sending the user pool ID token to S3 in each request.
- BB. A user pool for sign-in, and an identity pool that exchanges the user pool tokens for temporary AWS credentials.
- CC. An identity pool only, with users signing up directly in the identity pool with email and password.
- DD. A user pool with an app client secret embedded in the app to sign requests to S3.
Show the answer and explanation
Answer: B
- A. Wrong: S3 does not accept Cognito tokens. AWS service calls must be signed with AWS credentials.
- B. Right: Correct. The user pool authenticates the user, and the identity pool issues temporary credentials for an IAM role that can access S3.
- C. Wrong: Identity pools do not hold a user directory or handle sign-up. They federate identities from providers such as user pools.
- D. Wrong: A client secret authenticates the app client to the user pool. It is not an AWS credential and must not be embedded in a mobile app.
Explanation
User pools answer "who is this user?" by authenticating users and issuing JWTs. Identity pools answer "what AWS resources can they use?" by exchanging a trusted token for temporary, limited AWS credentials. Apps that call AWS services directly usually combine the two.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.