Examkin

Amazon Cognito Authentication and Authorization

71 questions

All types71Multiple choice35Multiple select36
Question 21Question →

A developer is building a mobile application that allows external users to authenticate using an external OpenID Connect (OIDC) identity provider. Once authenticated, users must be able to upload log files directly to a private Amazon S3 bucket. Each user's uploads must be restricted to an S3 folder named after their unique OIDC user identifier (the `sub` claim). The application also needs to write metadata for each upload to an Amazon DynamoDB table, using the same OIDC `sub` value as the partition key. Which solution meets these requirements with the least development effort and adheres to the principle of least privilege?

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with the OIDC provider as an identity provider, mapping the OIDC `sub` claim to a custom attribute. Configure an Amazon Cognito Identity Pool with the User Pool as an authentication provider, enabling 'Attributes for access control' to map the custom attribute to a principal tag. Reference the mapped tag using `${aws:PrincipalTag/...}` in the IAM policy for the authenticated role to authorize S3 and DynamoDB actions.

Answer

The correct solution is to configure the Amazon Cognito User Pool to map the OIDC `sub` claim to a custom attribute, map that attribute to a principal tag in the Identity Pool using 'Attributes for access control', and reference the tag via the policy variable in the IAM policy.
Mapping the OIDC `sub` claim to a Cognito User Pool custom attribute, exposing it as a Principal Tag via the Identity Pool's 'Attributes for access control', and utilizing the principal tag policy variable in the IAM policy is the most secure and operationally efficient way to implement attribute-based access control (ABAC) for federated users.

Step-by-Step Solution

1
Map the OIDC provider's unique `sub` claim to a custom attribute (e.g., `custom:oidc_sub`) in the Amazon Cognito User Pool during authentication setup.
The external provider's unique user identifier is captured and persisted in the Cognito user directory.
This makes the claim available for downstream mapping within AWS credentials session generation.
2
Enable 'Attributes for access control' in the Amazon Cognito Identity Pool and configure a mapping from the custom User Pool attribute `custom:oidc_sub` to a principal tag (e.g., `user_id`).
The identity provider claim is converted into a session tag (`aws:PrincipalTag/user_id`) attached to the temporary credentials issued by AWS STS.
This enables Attribute-Based Access Control (ABAC) dynamically on AWS services using IAM policy variables.
3
Create an IAM policy for the Cognito authenticated role that restricts S3 access to `arn:aws:s3:::my-bucket/aws:PrincipalTag/userid/∗‘andDynamoDBaccessbasedontheleadingkeymatching‘{aws:PrincipalTag/user_id}/*` and DynamoDB access based on the leading key matching `{aws:PrincipalTag/user_id}`.
Dynamic, fine-grained access control is enforced automatically for each unique user based on their federated OIDC session identifier.
This adheres to the principle of least privilege without creating separate IAM roles per user or writing token exchange logic.

Key Concept

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and federated OIDC providers.
Question 22Question →

To support file uploads in a new collaborative web portal, users must be able to sign up, sign in, and directly upload files to a private Amazon S3 bucket. The application needs to authenticate users and then obtain temporary AWS credentials for the uploads. Which TWO Amazon Cognito components should the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: A User Pool to manage user registration, sign-in, and provide a user directory.; An Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon S3.

Answer

The developer should implement a Cognito User Pool to manage user registration and sign-in, and a Cognito Identity Pool to exchange the authentication tokens for temporary AWS credentials to access Amazon S3.
To support the user registration, authentication, and S3 file uploads, both User Pools and Identity Pools are needed. A Cognito User Pool manages the user directory, sign-up, and sign-in processes (authentication). Once authenticated, a Cognito Identity Pool exchanges the resulting token for temporary AWS credentials (authorization) that the application's frontend can use to upload files directly to Amazon S3.

Step-by-Step Solution

1
Identify the authentication and directory management component.
Amazon Cognito User Pool.
User Pools serve as the user directory and handle user registration, sign-in, and identity tokens.
2
Identify the authorization component for accessing AWS resources.
Amazon Cognito Identity Pool.
Identity Pools exchange authentication tokens for temporary AWS credentials (via AWS STS) allowing client-side applications to access services like Amazon S3 directly.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and user directory) and Identity Pools (authorization and temporary AWS credentials for AWS resources).
Question 23Question →

An e-commerce application requires users to authenticate before they can download digital invoice PDFs directly from a private Amazon S3 bucket. The developer has set up user registration and authentication using Amazon Cognito. Which Cognito component must be configured to exchange the authenticated user session for temporary, limited-privilege AWS credentials?

Show answer & explanation

Answer: Cognito Identity Pools

Answer

Cognito Identity Pools
Cognito Identity Pools (Federated Identities) enable applications to obtain temporary, limited-privilege AWS credentials. These credentials allow client applications to make direct calls to AWS services such as Amazon S3, using IAM roles associated with the authenticated or unauthenticated identity pool users.

Step-by-Step Solution

1
Identify the primary requirement: the client application needs temporary, limited-privilege AWS credentials to interact directly with an AWS service (Amazon S3).
Temporary AWS credentials (access key, secret key, and session token) are required.
Direct calls to S3 APIs from a client application require AWS credentials rather than standard OAuth/OIDC identity or access tokens.
2
Evaluate the difference between Cognito User Pools and Cognito Identity Pools.
User Pools manage the user directory and authentication, while Identity Pools provide AWS credentials (authorization) based on successful authentication.
To bridge the gap between user identity (authentication) and AWS permissions (authorization), Cognito Identity Pools must be configured.

Key Concept

Amazon Cognito Identity Pools are used to federate identities and obtain temporary AWS credentials for accessing AWS resources directly.
Estimated Time:45s
Question 24Question →

A developer is building a serverless web application. The application requires users to register and sign in. Additionally, authenticated users must be allowed to upload files directly to a private Amazon S3 bucket. Which TWO Amazon Cognito components are required to meet these requirements?

Select all that apply

Show answer & explanation

Answer: An Amazon Cognito User Pool to manage user registration, authentication, and the user directory; An Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucket

Answer

The developer must use an Amazon Cognito User Pool to manage user registration, authentication, and the user directory, alongside an Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucket.
To implement user authentication (sign-up, sign-in, directory), a Cognito User Pool is required. To authorize the users to access AWS resources directly, such as uploading files to Amazon S3, an Amazon Cognito Identity Pool is required to exchange the User Pool tokens for temporary AWS IAM credentials.

Step-by-Step Solution

1
Implement a user directory and sign-up/sign-in flows using Amazon Cognito User Pools.
Users are authenticated and receive JSON Web Tokens (JWTs) representing their identity.
To verify user identities and manage their authentication status.
2
Configure an Amazon Cognito Identity Pool and link it to the Cognito User Pool.
The client application can exchange the User Pool JWTs for temporary AWS credentials.
To authorize authenticated users to access AWS services directly.
3
Assign an IAM Role to the authenticated user group in the Identity Pool with permissions to write to the Amazon S3 bucket.
The temporary AWS credentials grant the necessary permissions to write files directly to Amazon S3.
To enforce fine-grained access control on the target AWS resource.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and identity directory) and Identity Pools (authorization and temporary AWS credentials).
Question 25Question →

A developer is building a mobile game that needs to save user progress data directly to an Amazon DynamoDB table. Users must first authenticate, and the application must then obtain temporary, limited-privilege AWS credentials to authorize write operations to the DynamoDB table. Which Amazon Cognito feature should the developer use to obtain these temporary AWS credentials?

Show answer & explanation

Answer: Cognito Identity Pools

Answer

Cognito Identity Pools
Cognito Identity Pools (Federated Identities) are specifically designed to authorize users by exchanging authentication tokens (from Cognito User Pools or social providers) for temporary, limited-privilege AWS credentials. This allows mobile applications to call AWS services directly, such as writing to DynamoDB, using the permissions defined in the assumed IAM role.

Step-by-Step Solution

1
Identify the authentication and authorization requirements.
The application requires authentication to verify identity, and then authorization using temporary AWS credentials to write directly to DynamoDB.
Determining whether the client needs direct AWS resource access versus REST API access helps select the correct Cognito feature.
2
Differentiate between User Pools and Identity Pools.
Cognito User Pools provide user directories and authentication (JWTs). Cognito Identity Pools provide authorization by exchanging authentication tokens for temporary AWS credentials.
Selecting the feature that specifically generates temporary credentials ensures secure, direct SDK access to AWS services.

Key Concept

Amazon Cognito Identity Pools vs User Pools for AWS resource access
Estimated Time:45s
Question 26Question →

A developer is building a serverless backend where users must register and sign in to access private API Gateway endpoints. The developer wants to use built-in AWS features to authenticate users and control access to the APIs with minimal custom code.

Which TWO Amazon Cognito features or configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An Amazon Cognito User Pool to manage user registration, sign-in, and token generation.; An Amazon Cognito Authorizer in API Gateway to validate the JSON Web Tokens (JWTs) returned after user authentication.

Answer

Implementing an Amazon Cognito User Pool and configuring an Amazon Cognito Authorizer in API Gateway
To authenticate users and authorize API Gateway requests with minimal overhead, a developer should use an Amazon Cognito User Pool to handle user directory services (registration and sign-in) and token issuance, and pair it with an API Gateway Cognito Authorizer to validate those tokens at the API entry point.

Step-by-Step Solution

1
Set up user authentication and directory
Create an Amazon Cognito User Pool to serve as the user directory and handle registration, sign-in, and the issuance of JWT tokens.
This establishes the identity store and authentication mechanism for the application.
2
Configure API Gateway authorization
Configure an Amazon Cognito Authorizer on the API Gateway resource and point it to the Cognito User Pool.
This enables API Gateway to automatically intercept incoming requests, extract the JWT token from the Authorization header, and validate it against the User Pool.

Key Concept

Amazon Cognito User Pools provide authentication and issue tokens, while API Gateway Cognito Authorizers provide built-in token validation for authorization.
Question 27Question →

A developer is designing a secure integration for an enterprise application. While human users authenticate interactively via an Amazon Cognito User Pool, an external partner’s automated service must programmatically invoke a specific Amazon API Gateway REST API. The partner's service needs to perform machine-to-machine (M2M) communication without any user interaction. Which configuration meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.

Answer

Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.
Configuring a Cognito resource server and using the Client Credentials grant flow allows machine-to-machine clients to obtain OAuth 2.0 access tokens. API Gateway Cognito authorizers can natively validate these access tokens and restrict access based on the configured custom scopes. This requires no custom validation code or external identity pools.

Step-by-Step Solution

1
Analyze the client interaction requirements.
The requirement calls for machine-to-machine (M2M) communication without user interaction.
This rules out interactive authorization flows like Authorization Code or Implicit, pointing towards the OAuth 2.0 Client Credentials grant flow.
2
Select the appropriate Amazon Cognito feature set.
Amazon Cognito User Pools support OAuth 2.0 resource servers, custom scopes, and client clients with the Client Credentials grant.
Using a User Pool is more lightweight than building a custom credential exchange service with Cognito Identity Pools.
3
Determine the API Gateway integration strategy.
API Gateway's built-in Cognito authorizer can validate access tokens containing custom scopes natively.
Using a native authorizer avoids writing custom Lambda code to verify JWT signatures, reducing operational overhead and request latency.

Key Concept

Amazon Cognito User Pool Resource Servers and Client Credentials Flow
Question 28Question →

A developer is building a web application and needs to implement user sign-up, sign-in, and password recovery features to manage the application's user directory. The application does not require users to access any AWS resources directly. Which Amazon Cognito feature should the developer use to meet these requirements?

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools
Amazon Cognito User Pools is the correct component because it functions as a user directory that provides sign-up, sign-in, and self-service password recovery workflows out-of-the-box, which matches the application's requirement to manage end-user authentication without needing access to AWS resources.

Step-by-Step Solution

1
Identify the primary requirement: managing a user directory with sign-up, sign-in, and password recovery capabilities for an application's end-users.
Requires an authentication directory service rather than an authorization service for AWS resources.
The scenario specifies managing sign-up, sign-in, and password recovery without needing direct access to AWS resources.
2
Compare the core functions of Cognito User Pools and Cognito Identity Pools.
User Pools provide identity provider and user directory services. Identity Pools provide temporary AWS credentials for accessing AWS resources.
This avoids the common misconception of confusing User Pools (authentication/directory) with Identity Pools (authorization/credentials).

Key Concept

Amazon Cognito User Pools provide authentication, user directories, and profile management for application users, whereas Identity Pools provide authorization to AWS resources via temporary credentials.
Estimated Time:45s
Question 29Question →

A developer is building a mobile application that allows users to register, log in, and upload photos directly to a private Amazon S3 bucket. The developer wants to use Amazon Cognito for user management and secure access. Which TWO options represent the correct configuration of Amazon Cognito services required to meet these objectives?

Select all that apply

Show answer & explanation

Answer: Amazon Cognito User Pools to handle user sign-up, sign-in, and authentication token issuance; Amazon Cognito Identity Pools to federate user identity and obtain temporary AWS credentials for Amazon S3 access

Answer

Amazon Cognito User Pools are used to manage user authentication and token issuance, while Amazon Cognito Identity Pools are used to exchange these tokens for temporary AWS credentials to access AWS resources such as Amazon S3.
The correct options are the ones implementing Cognito User Pools for user authentication and directory management, and Cognito Identity Pools for exchanging the resulting tokens into temporary AWS credentials for S3 access.

Step-by-Step Solution

1
Identify the authentication requirement.
The application needs user registration, sign-in, and token management, which is handled by Amazon Cognito User Pools.
User Pools act as the user directory and provide identity management.
2
Identify the authorization requirement for AWS resources.
The application needs to grant authenticated users access to Amazon S3 to upload files.
Accessing AWS resources directly from client apps requires temporary credentials.
3
Determine the resource that yields temporary AWS credentials.
Amazon Cognito Identity Pools (Federated Identities) can take the token from the User Pool and exchange it for temporary AWS credentials via an IAM role.
Identity Pools are designed to authorize access to AWS resources.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication/user directory) and Identity Pools (authorization/temporary credentials).
Estimated Time:1m 0s
Question 30Question →

A developer is designing a web-based smart-home dashboard. Users must sign in using an external corporate OpenID Connect (OIDC) identity provider. After signing in, the dashboard client application must be able to:

1. Invoke an Amazon API Gateway REST API to retrieve telemetry data, using the user's authenticated profile to authorize the requests.
2. Download device logs directly from a private Amazon S3 bucket, where each user has access only to their own device subfolder (prefixed with their user ID).

Which TWO configurations are required to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, and configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API.; Configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, and associate an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.

Answer

The developer must configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API, and configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, associating an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.
To authenticate external OIDC users and secure the API Gateway REST API, the developer should configure an Amazon Cognito User Pool with the OIDC provider as a federated identity provider, and secure the API Gateway with a built-in Cognito authorizer. To allow secure, direct S3 downloads using dynamic user-specific prefixes, the developer should configure an Amazon Cognito Identity Pool linked to the User Pool, and map authenticated users to an IAM role that uses policy variables to restrict access to their specific directory prefix.

Step-by-Step Solution

1
Set up User Authentication
Configure an Amazon Cognito User Pool to federate with the external OIDC provider. This allows the web dashboard client to authenticate users and obtain JSON Web Tokens (JWTs) representing their identity.
Cognito User Pools serve as the identity directory and handle the OIDC handshake, token issuance, and user profile management.
2
Secure API Gateway REST API
Configure a built-in Cognito Authorizer on Amazon API Gateway REST API pointing to the User Pool. The client will pass the identity token in the authorization header.
Using the built-in Cognito Authorizer validates the JWT signature and expiration automatically, reducing operational overhead and custom code.
3
Enable Fine-Grained AWS Resource Access
Create a Cognito Identity Pool (federated identities) and configure the User Pool as an authentication provider. Map the authenticated role to an IAM role that permits S3 operations on prefixes filtered by the Cognito identity ID policy variable.
Cognito Identity Pools exchange the User Pool JWT for temporary, limited-privilege AWS credentials, allowing direct, secure S3 downloads without exposing long-lived IAM keys.

Key Concept

Cognito User Pools authenticate users and issue tokens, while Cognito Identity Pools authorize access to AWS resources by exchanging these tokens for temporary AWS credentials.
Question 31Question →

A developer is building a new web application and needs to implement user registration, login, and profile management. The developer wants to store user profile data directly in a managed user directory and support federated sign-in through external identity providers. Which Amazon Cognito feature should the developer use?

Show answer & explanation

Answer: Amazon Cognito user pools

Answer

Amazon Cognito user pools
Amazon Cognito user pools act as user directories that provide sign-up and sign-in services for web and mobile applications. They store user profiles and support authentication using external identity providers.

Step-by-Step Solution

1
Analyze the requirements for storing user profiles, managing registration/login, and supporting federated identity providers.
The requirements point to a need for a managed user directory.
Before selecting a service, the specific authentication vs. authorization needs must be identified.
2
Distinguish between the directories component and the credentials federation component of Amazon Cognito.
User Pools manage authentication and directories, while Identity Pools manage authorization and temporary AWS credentials.
This prevents mixing up the two main features of Amazon Cognito.
3
Select the component that natively matches the directory, registration, and login requirements.
Amazon Cognito user pools is the correct selection.
User Pools are specifically designed to act as the identity provider and user directory.

Key Concept

Distinction between Amazon Cognito User Pools and Identity Pools
Estimated Time:45s
Question 32Question →

A company is developing a client-side web application where users need to log in to their accounts and then upload profile images directly to a private Amazon S3 bucket. Which Amazon Cognito features should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Cognito User Pools to manage user registration, authentication, and directory services.; Amazon Cognito Identity Pools to authorize users and retrieve temporary AWS credentials for S3 bucket access.

Answer

To authenticate users and obtain temporary AWS credentials for S3 uploads, the developer should use Amazon Cognito User Pools for user directory management, and Amazon Cognito Identity Pools to authorize and obtain temporary AWS credentials.
The correct solution involves using Amazon Cognito User Pools to authenticate the users and manage their directory, combined with Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS credentials that allow the client application to upload files to the S3 bucket directly.

Step-by-Step Solution

1
Select the component for user directory management and authentication.
Use Amazon Cognito User Pools.
Cognito User Pools provide sign-up and sign-in services for web and mobile application users.
2
Select the component to exchange identity tokens for temporary AWS security credentials.
Use Amazon Cognito Identity Pools (Federated Identities).
Cognito Identity Pools enable you to grant authenticated users temporary AWS credentials to access AWS services such as Amazon S3 directly.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).
Question 33Question →

A developer is building a mobile fitness tracking app. The app requires users to create an account, sign in with a username and password, and manage their profile data. The application does not need to access other AWS services directly from the mobile client. Which Amazon Cognito feature should the developer implement to provide the user directory and authentication services?

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools
Amazon Cognito User Pools provide a fully managed user directory that handles user registration, authentication (sign-up/sign-in), and profile management. Since the application does not require direct access to other AWS services from the mobile client, a User Pool alone satisfies the requirements.

Step-by-Step Solution

1
Analyze the requirements for user authentication, registration, and directory management in the mobile application context.
The application needs a secure user directory to store profile data, along with registration (sign-up) and login (sign-in) flows.
This identifies that the core need is authentication (AuthN) and user management, not AWS resource authorization (AuthZ).
2
Evaluate the role of Amazon Cognito User Pools for this requirement.
Amazon Cognito User Pools act as the identity provider, containing the user directory, sign-up, sign-in, and account recovery features out-of-the-box.
Since the app only needs to authenticate users and manage their profiles without accessing other AWS resources directly, a User Pool is the correct and complete solution.
3
Distinguish from Cognito Identity Pools and other security configurations.
Cognito Identity Pools are for granting temporary credentials for AWS resources, which is not needed. Custom Lambda Authorizers control API Gateway access, and hardcoded IAM keys violate security best practices.
This rules out the incorrect options and confirms that a Cognito User Pool is the most appropriate and secure architecture.

Key Concept

Cognito User Pools vs. Identity Pools
Estimated Time:45s
Question 34Question →

A developer is building a mobile fitness application that integrates with an Amazon API Gateway REST API backed by AWS Lambda. The application requires users to sign in using their corporate Google Workspace accounts via OpenID Connect (OIDC). Once authenticated, the mobile client must send a secure token with every API request. The API Gateway must validate this token before forwarding the request to the Lambda function. Additionally, the Lambda function needs to access the user's Cognito group memberships to enforce fine-grained access control.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.

Answer

Configure an Amazon Cognito User Pool with Google as an identity provider, secure the API Gateway using a built-in Cognito User Pool authorizer with Lambda proxy integration, and inspect the requestContext.authorizer.claims object in the Lambda function.
The correct solution utilizes an Amazon Cognito User Pool to manage authentication with the OIDC provider (Google) and secures the API Gateway REST API using the native Cognito User Pool authorizer. This authorizer validates incoming JSON Web Tokens (JWTs) automatically without writing custom code. Using a Lambda proxy integration ensures that all claims, including user groups, are parsed and passed in the requestContext.authorizer.claims object of the Lambda event payload, minimizing operational overhead.

Step-by-Step Solution

1
Determine the correct Cognito pool type for directory authentication and federation.
Cognito User Pool is selected because it acts as the user directory and supports OIDC/SAML federation, whereas Identity Pools are used for authorization and vending temporary AWS credentials.
The scenario requires users to sign in and authenticate via Google Workspace before accessing custom API endpoints.
2
Select the appropriate API Gateway authorization mechanism to validate the token with minimal overhead.
API Gateway Cognito User Pool Authorizer is selected instead of a custom Lambda Authorizer.
API Gateway native Cognito authorizers validate JWTs automatically without writing or maintaining custom code, reducing latency and operational overhead.
3
Configure the API Gateway integration and access token claims in the backend Lambda function.
Configure API Gateway with Lambda proxy integration. Retrieve the groups from the event's requestContext.authorizer.claims context object.
Lambda proxy integration automatically populates validated token claims in the event payload, allowing the backend function to perform fine-grained authorization using trusted group data.

Key Concept

Amazon Cognito User Pool Authorizer integration with Amazon API Gateway and Lambda proxy integration.
Question 35Question →

A developer is building a document search portal. The portal must support user registration and sign-in. Once authenticated, users must be able to call an Amazon API Gateway REST API to search for document metadata, and then download the corresponding PDF files directly from a private Amazon S3 bucket. Which TWO actions should the developer take to implement the authentication and authorization for this portal?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.; Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.

Answer

To secure the portal, the developer must configure an Amazon Cognito User Pool to handle user registration and authentication, utilizing a Cognito Authorizer on the API Gateway REST API. The developer must also configure an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS IAM credentials allowing direct S3 access.
The correct strategy leverages the Amazon Cognito User Pool to manage authentication and user profiles, paired with a Cognito Authorizer on API Gateway to validate the resulting tokens. The Amazon Cognito Identity Pool is then utilized to exchange these tokens for temporary AWS credentials so the client can safely read objects from S3 without passing static credentials or routing file payloads through API Gateway.

Step-by-Step Solution

1
Configure user authentication and API protection.
Amazon Cognito User Pool is created, and the API Gateway API is configured with a Cognito Authorizer.
This establishes a user directory for registration/sign-in and allows API Gateway to validate user tokens natively.
2
Configure direct S3 access authorization.
Amazon Cognito Identity Pool is created, linked to the User Pool, and mapped to an IAM role with S3 read permissions.
This enables clients to exchange their User Pool tokens for temporary AWS IAM credentials to retrieve files directly from S3.

Key Concept

Distinction between Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization of AWS resource access.
Question 36Question →

A developer is designing a new web application and needs to implement user sign-up, sign-in, and directory management capabilities. Which Amazon Cognito component should the developer use to meet these requirements?

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools
The correct answer is Amazon Cognito User Pools because they function natively as a user directory, offering built-in workflows for user registration, user authentication, password recovery, and directory management.

Step-by-Step Solution

1
Analyze the core requirements of the application: user sign-up, sign-in, and user directory management.
The application needs an identity provider that can store user credentials, manage user profiles, and issue identity tokens.
This establishes that the task is authentication and identity management.
2
Compare Cognito features against these requirements.
Cognito User Pools provide a serverless user directory, host registration/authentication pages, and issue tokens (ID, access, refresh). Cognito Identity Pools, conversely, provide temporary credentials to access AWS resources.
This clarifies the distinction between user authentication (directories) and resource authorization (credentials).
3
Select the correct component.
Amazon Cognito User Pools satisfies all requirements with minimal configuration.
It matches the target use case perfectly, leaving other components for authorization or custom integration.

Key Concept

Amazon Cognito User Pools are user directories used for authentication (sign-up, sign-in, password reset), whereas Cognito Identity Pools are used for authorization (granting temporary AWS credentials).
Question 37Question →

An engineering team is developing a document management application. The application's frontend is a single-page application (SPA). The backend APIs are deployed on Amazon API Gateway (REST API) with AWS Lambda integrations. The application uses an Amazon Cognito User Pool for user authentication, which includes federated identity providers. The backend Lambda functions must receive the authenticated user's custom department attribute ('custom:department') to authorize document access at the application layer. The developers want to implement a highly performant and secure authorization mechanism that minimizes API calls and operational overhead.

Which solution should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito ID token in the Authorization header of API requests. Access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].

Answer

Configure an Amazon API Gateway Cognito User Pool Authorizer, configure the frontend to send the Cognito ID token in the Authorization header of API requests, and access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].
The correct solution uses the built-in API Gateway Cognito User Pool Authorizer along with the Cognito ID token. The ID token natively carries user profile attributes, including the custom department attribute. Once validated by the authorizer, API Gateway automatically injects these claims into the Lambda integration context under the path 'event.requestContext.authorizer.claims'. This fulfills the security and functional requirements without requiring any custom validation code, downstream API queries, or Cognito Identity Pool credential exchanges, thereby minimizing execution latency and operational overhead.

Step-by-Step Solution

1
Select the appropriate Amazon Cognito token type.
Cognito ID tokens contain user identity claims, including custom attributes such as 'custom:department', whereas standard Access tokens do not contain these user-specific directory attributes by default.
Choosing the ID token ensures that the required custom user attributes are sent to the gateway without requiring back-channel API requests to retrieve them.
2
Configure the API Gateway Authorizer.
Create a built-in Cognito User Pool Authorizer on API Gateway and associate it with the REST API resource methods. Set the Authorization header as the token source.
Using the built-in Cognito Authorizer offloads token signature verification and expiration checks to API Gateway, avoiding the operational overhead of managing custom authorizer functions.
3
Extract claims inside the backend Lambda function.
In the backend Lambda handler, read the custom attribute from 'event.requestContext.authorizer.claims["custom:department"]'.
When using a Cognito User Pool Authorizer with API Gateway Lambda proxy integration, the gateway automatically populates the claims from the validated ID token into the request context, allowing the backend to retrieve the attribute with zero database or API lookups.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers natively validate ID tokens and inject user claims, including custom attributes, into the backend Lambda context, avoiding the latency and cost of custom authorizers or downstream user lookup APIs.
Estimated Time:2m 0s
Question 38Question →

A developer is building a serverless web application that allows users to sign in and upload files directly to an Amazon S3 bucket. The application must support user registration and sign-in, and provide temporary AWS credentials to authenticated users for S3 uploads. Which two Amazon Cognito features should the developer configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Cognito User Pools to manage user registration, authentication, and directory services; Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access

Answer

Amazon Cognito User Pools to manage user registration, authentication, and directory services, and Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access.
To support user sign-up and authentication, a Cognito User Pool is required. To authorize the users and grant temporary AWS credentials for direct S3 upload access, a Cognito Identity Pool is required.

Step-by-Step Solution

1
Determine the service needed for user authentication and directory management.
Amazon Cognito User Pools provides the directory and authentication features required for user registration and sign-in.
User Pools handle authentication and act as the identity provider.
2
Determine the service needed to access AWS resources directly from the client.
Amazon Cognito Identity Pools (federated identities) allows exchanging authentication tokens for temporary AWS IAM credentials.
Identity Pools manage authorization and provide credentials for AWS resources like Amazon S3.

Key Concept

Cognito User Pools authenticate users and manage directories, while Cognito Identity Pools authorize users to access AWS resources by issuing temporary credentials.
Question 39Question →

A startup is building a new mobile application for ride-sharing. The developer needs to establish a secure user directory that manages user registration, sign-in, password recovery, and multi-factor authentication (MFA).

Which Amazon Cognito feature should the developer implement to meet these requirements?

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools
Amazon Cognito User Pools is the correct choice because it is a user directory that provides sign-up and sign-in options for web and mobile applications, including features like user directory management, password recovery, and multi-factor authentication (MFA).

Step-by-Step Solution

1
Identify the primary requirement, which is to build a secure user directory for managing user registration, sign-in, password recovery, and multi-factor authentication (MFA).
The requirement points to a user directory management and authentication solution.
Determining whether authentication/user directory or authorization/AWS resource access is needed.
2
Compare Cognito User Pools and Cognito Identity Pools.
User Pools handle authentication, registration, and user directory management, whereas Identity Pools handle authorization by exchanging tokens for temporary AWS credentials.
Cognito User Pools is the direct match for hosting a user directory and managing user signup/signin.

Key Concept

Amazon Cognito User Pools provide authentication and user directory management, whereas Identity Pools provide authorization to AWS resources.
Question 40Question →

A developer is building a new web application that allows users to sign up, sign in, and download files directly from a private Amazon S3 bucket. The application must handle user directory management and authenticate users before granting them temporary access to S3. Which two Amazon Cognito resources should the developer configure to satisfy these authentication and authorization requirements?

Select all that apply

Show answer & explanation

Answer: A Cognito User Pool to manage user registration, authentication, and the user directory.; A Cognito Identity Pool to exchange authentication tokens for temporary AWS credentials to access S3.

Answer

To meet the requirements, the developer must configure a Cognito User Pool to handle user directory management and authentication, and a Cognito Identity Pool to authorize access and provide temporary AWS credentials for the S3 bucket.
The correct solution involves configuring both a Cognito User Pool and a Cognito Identity Pool. The User Pool manages user directory services (registration, login, password recovery), and the Identity Pool handles authorization by exchanging the authenticated user's tokens for temporary AWS IAM credentials so the application can access the S3 bucket directly.

Step-by-Step Solution

1
Identify the authentication and directory management requirement.
Amazon Cognito User Pools must be configured because they act as the identity provider, handling registration, sign-in, and tokens.
User Pools are specifically designed to serve as a user directory and manage authentication flow.
2
Identify the authorization and AWS resource access requirement.
Amazon Cognito Identity Pools must be configured to federate the User Pool tokens.
Identity Pools are designed to exchange authentication tokens (such as OIDC tokens from a User Pool) for temporary AWS credentials via AWS STS.
3
Configure the client application to obtain S3 access.
The client app authenticates with the User Pool, sends the resulting token to the Identity Pool, receives temporary AWS credentials, and uses them to access the S3 bucket directly.
This flow leverages AWS best practices for secure web client interactions with AWS services.

Key Concept

Separation of concerns between Cognito User Pools (authentication/directory) and Cognito Identity Pools (authorization/AWS credentials).
Estimated Time:1m 0s
PreviousPage 2 / 4Next
Amazon Cognito Authentication and Authorization Practice Questions — AWS Certified Developer - Associate — Page 2 | Examkin