Exams / DVA-C02 / Amazon Cognito and federated access / Question 3
DVA-C02 practice question: Amazon Cognito and federated access (3 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An app already uses an Amazon Cognito user pool for email sign-in. The product team wants users to be able to sign in with their Google or Apple accounts as well, and the backend should keep receiving the same user pool tokens whichever way a user signs in. What should the developer do?
Choose one answer.
- AA. Create a separate user pool for each social provider and merge the tokens in the backend.
- BB. Have the backend validate Google and Apple tokens itself alongside user pool tokens.
- CC. Add Google and Apple as social identity providers in the existing user pool.
- DD. Turn on multi-factor authentication in the user pool for Google and Apple users.
Show the answer and explanation
Answer: C
- A. Wrong: This splits users across pools and gives the backend several token issuers to handle.
- B. Wrong: This works around Cognito rather than using it, and the backend would have to handle three token formats.
- C. Right: Correct. The user pool federates with the providers and then issues its own standard tokens to the app.
- D. Wrong: MFA adds a second sign-in factor. It does not let users sign in with external accounts.
Explanation
Cognito user pools can federate sign-in with social providers such as Google, Facebook, Login with Amazon and Apple. Cognito handles the OAuth 2.0 and OIDC exchanges and then issues one standard set of user pool tokens, so the backend sees a single token format.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.