A company uses Amazon Cognito User Pools for customer authentication. They want to implement a custom security requirement: if a user logs in from an IP address that is different from their last login, they must be prompted for Multi-Factor Authentication (MFA). If the IP is the same, MFA should be bypassed. How can the architect implement this logic?

Answer options:

Enable Cognito Advanced Security Features and set the risk-based authentication to 'High'.

Use an AWS Lambda trigger for the 'Define Auth Challenge' and 'Create Auth Challenge' stages in Cognito.

Configure AWS WAF with a custom rule to inspect the IP and trigger an MFA redirect.

Use an IAM policy with the aws:SourceIp condition key attached to the Cognito User Pool.

How to approach this question

Look for the extensibility feature of Cognito (Lambda triggers).

Full Answer

B.Use an AWS Lambda trigger for the 'Define Auth Challenge' and 'Create Auth Challenge' stages in Cognito.✓ Correct

Use an AWS Lambda trigger for the 'Define Auth Challenge' and 'Create Auth Challenge' stages in Cognito.

Amazon Cognito User Pools support custom authentication flows via AWS Lambda triggers. By using the 'Define Auth Challenge', 'Create Auth Challenge', and 'Verify Auth Challenge Response' triggers, you can implement custom logic like IP-based conditional MFA.

Common mistakes

Assuming WAF can handle authentication logic.

Question 45 All questions Question 47

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 4

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium

View all 75 questions →