SCS-C03 practice question: Customer and app identity (Amazon Cognito) (1 of 2)
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional bank runs a mobile banking app that uses an Amazon Cognito user pool for sign-in. The fraud team has seen account takeovers in which criminals reuse passwords leaked in unrelated breaches.
Customers on a familiar device should not be asked for a second factor at every sign-in. Sign-ins from unfamiliar devices or locations must require one, and high-risk sign-ins and known leaked passwords must be blocked. The app team does not want to write risk-scoring code.
Which solution meets these requirements with the LEAST custom code?
Choose one answer.
AA. Keep MFA optional, and add a pre authentication Lambda trigger that compares each sign-in IP address with a stored list of known addresses for each customer, blocking any that do not match.
BB. Set MFA to optional and turn on threat protection in full-function mode. Require MFA for medium-risk sign-ins, and block high-risk sign-ins and compromised credentials.
CC. Require SMS MFA for every sign-in, and associate an AWS WAF web ACL with the user pool that blocks clients sending more than 100 sign-in requests in five minutes.
DD. Turn on threat protection in audit-only mode, and send the risk events to a dashboard that the fraud team reviews each morning to disable risky accounts by hand.
Show the answer and explanation
Answer: B
A. Wrong: The trigger can block some sign-ins, but it is custom risk-scoring code that the team does not want to write. An address list also fails customers who travel, and it cannot detect leaked passwords.
B. Right: Correct. Threat protection scores each sign-in for risk, including unfamiliar devices and locations, and detects passwords found in public breaches. Adaptive authentication then asks for a second factor or blocks the sign-in, with no custom scoring code. Learn more: Threat protection for Amazon Cognito user pools (opens in a new tab)
C. Wrong: Customers on familiar devices would be asked for a second factor every time, which the bank wants to avoid. A slow attack with leaked passwords would also stay under the rate limit.
D. Wrong: Audit-only mode logs risk but takes no action, so high-risk sign-ins and leaked passwords are not blocked. A morning review leaves accounts exposed for hours.
Explanation
Cognito threat protection in full-function mode scores each sign-in and detects compromised credentials. Adaptive authentication turns that risk into a second-factor challenge or a block, so customers on familiar devices are not challenged every time. Custom triggers, always-on SMS with rate limits, and audit-only mode each miss a requirement.
Want more on Customer and app identity (Amazon Cognito)? The 5 full-length practice sets have 5 more Customer and app identity (Amazon Cognito) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →