SCS-C03 practice question: Customer and app identity (Amazon Cognito) (2 of 2)

Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A subscription company runs a customer web app and an admin console through the same Amazon API Gateway REST API. Users sign in with an Amazon Cognito user pool, and support staff belong to a group named support-admins.

Only members of support-admins may call the routes under /admin. Customers must not be able to call those routes even with a valid token. The team does not want to run a separate token server, and route access must change when staff join or leave the group.

Which solution meets these requirements?

Choose one answer.

A. Attach the Cognito user pool authorizer to the whole API. Create a second app client for support staff, so that only staff tokens can be issued for the admin routes.
B. Attach a Lambda authorizer to the /admin routes that verifies the Cognito token and returns an IAM policy allowing the call only when the cognito:groups claim includes support-admins.
C. Store a support flag in a custom attribute, and have the web app send an x-support header with each admin request. The API then checks that header against the value in the user's profile before it forwards the call.
D. Create a separate API Gateway REST API for the admin console with an IAM authorizer, and create IAM users in the same account for each support employee. Keep the customer API on the Cognito authorizer.

Show the answer and explanation

Answer: B

A. Wrong: Restricting app clients changes which users can sign in, not which token a user holds on each call. Any valid token from the pool passes the authorizer, so a customer could still call the admin routes.
B. Right: Correct. The authorizer checks the signed token, then allows the admin routes only for tokens that carry the group claim. Group changes take effect when the user next receives a token, with no separate token server to run. Learn more: Control access to an API with a Lambda authorizer (opens in a new tab)
C. Wrong: The browser sets the header, so a customer can send any value it likes. The API would trust client input instead of a signed claim, so the check is not reliable for access control.
D. Wrong: IAM users for support staff bring long-term credentials, and each staff change now needs IAM user management. The requirement is to follow the Cognito group, so this option creates a second identity system to run.

Explanation

A Cognito user pool authorizer checks that a token is valid, but it does not check group membership on each route. A Lambda authorizer can read the signed cognito:groups claim and allow only the admin routes for support staff. Custom headers and IAM users each fail the trust or overhead requirement.

SCS-C03 practice question: Customer and app identity (Amazon Cognito) (2 of 2)

Explanation

Study

Keep practicing