Exams / DVA-C02 / Amazon Cognito and federated access / Question 2
DVA-C02 practice question: Amazon Cognito and federated access (2 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A travel app lets visitors browse destination photos stored in Amazon S3 before they create an account. Visitors who have not signed in must get read-only access to one S3 prefix, using temporary credentials. What should the developer use?
Choose one answer.
- AA. An IAM user whose access key is shipped inside the app.
- BB. A Cognito user pool with a shared guest account that all visitors sign in with.
- CC. A public bucket policy that allows anyone to read the whole bucket.
- DD. A Cognito identity pool with guest access mapped to a narrowly scoped IAM role.
Show the answer and explanation
Answer: D
- A. Wrong: Long-term keys embedded in an app can be extracted and misused. They are not temporary.
- B. Wrong: A shared account means shared passwords and still needs a way to obtain AWS credentials. It is not a guest access feature.
- C. Wrong: This gives everyone access to everything, which is broader than one prefix, and uses no credentials at all.
- D. Right: Correct. Identity pools can issue limited temporary credentials to users who have not signed in, through a role you scope down.
Explanation
Cognito identity pools can issue temporary AWS credentials to unauthenticated guests as well as signed-in users. Each case maps to its own IAM role, so guests can be given narrow access, such as reading one prefix, while signed-in users get more.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.