ExpertMinds LogoExpertMinds
Hard1 markMultiple Choice
Domain 1.1: Secure AccessDomain 1SecurityCognitoDynamoDB

AWS SAA-C03 · Question 04 · Domain 1.1: Secure Access

A mobile application needs to access Amazon DynamoDB directly to read user-specific data. The application uses a third-party identity provider (IdP) like Google or Facebook for user authentication. What is the MOST secure way to grant the mobile app access to DynamoDB?

Answer options:

A.

Use Amazon Cognito User Pools to authenticate users and attach an IAM policy directly to the User Pool.

B.

Use Amazon Cognito Identity Pools to exchange the third-party token for temporary AWS credentials mapped to an IAM role.

C.

Embed an IAM user's access keys in the mobile application code.

D.

Configure DynamoDB to allow public read access and filter results within the mobile application.

How to approach this question

Distinguish between Cognito User Pools (authentication/sign-in) and Identity Pools (authorization/AWS credentials).

Full Answer

B.Use Amazon Cognito Identity Pools to exchange the third-party token for temporary AWS credentials mapped to an IAM role.✓ Correct
Use Amazon Cognito Identity Pools to exchange the third-party token for temporary AWS credentials mapped to an IAM role.
Amazon Cognito Identity Pools enable you to grant your users access to other AWS services. Identity pools support anonymous guest users, as well as federation through third-party IdPs. The identity pool exchanges the IdP token for temporary AWS credentials.

Common mistakes

Confusing Cognito User Pools with Identity Pools.
03All questions05

Practice the full AWS SAA-C03 Practice Exam 1

65 questions · hints · full answers · grading

Sign up freeTake the exam

More questions from this exam

Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team wants...MediumQ02A solutions architect is designing an application that will run on Amazon EC2 instances. The appl...EasyQ03A company wants to implement a federated identity solution for its employees to access the AWS Ma...MediumQ05A company is hosting a web application on Amazon EC2 instances. The application connects to an Am...MediumQ06A solutions architect is reviewing the security of an AWS account. The architect notices that the...Easy
View all 65 questions →