ExpertMinds LogoExpertMinds
Hard1 markMultiple Choice
Domain 1.1: Secure AccessSecurityCognitoMobileIAM

AWS SAA-C03 · Question 04 · Domain 1.1: Secure Access

A company is building a mobile app that requires users to authenticate using their social media accounts (Google, Facebook). Once authenticated, the app needs to directly access an Amazon S3 bucket to upload profile pictures. <br/><br/>Which combination of AWS services should the solutions architect use to provide this functionality MOST securely?

Answer options:

A.

Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization to access S3.

B.

AWS IAM Identity Center (AWS SSO) for authentication and IAM roles for authorization.

C.

Amazon Cognito Identity Pools for authentication and AWS IAM users for authorization.

D.

AWS Directory Service for authentication and Amazon Cognito User Pools for authorization.

How to approach this question

Differentiate between Cognito User Pools (authentication/directory) and Identity Pools (authorization/AWS credentials).

Full Answer

A.Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization to access S3.✓ Correct
Amazon Cognito User Pools provide a user directory and handle authentication (including social federation). Cognito Identity Pools (Federated Identities) take the authentication tokens and exchange them for temporary, limited-privilege AWS IAM credentials to access AWS resources like S3.

Common mistakes

Confusing the roles of User Pools and Identity Pools.
03All questions05

Practice the full AWS SAA-C03 Practice Exam 4

65 questions · hints · full answers · grading

Sign up freeTake the exam

More questions from this exam

Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team wants...MediumQ02An application running on Amazon EC2 instances needs to access an Amazon DynamoDB table. Both res...EasyQ03A company is designing a web application that will be hosted on AWS. The application will use an ...MediumQ05A solutions architect is designing a VPC for a three-tier web application. The database tier must...MediumQ06A company requires that all data stored in Amazon S3 must be encrypted at rest using keys managed...Easy
View all 65 questions →