CLF-C02 Cloud Technology and Services Practice Question
Which AWS service enables developers to add user sign-up, sign-in, and access control to web and mobile applications quickly?
⚠ Common exam trap
Test-takers frequently confuse AWS IAM (which manages internal AWS users and permissions) with Amazon Cognito (which manages external application users), leading candidates to pick IAM for customer-facing authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito
Amazon Cognito is the correct AWS service for adding user sign-up, sign-in, and access control to web and mobile applications. It provides identity pools and user pools that handle authentication, authorization, and user management, including social identity providers (e.g., Google, Facebook) and enterprise federation via SAML 2.0 or OIDC. This allows developers to quickly integrate these features without building custom backend infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Directory Service
Why it's wrong here
AWS Directory Service provides managed Microsoft Active Directory (and Simple AD/AD Connector) that enterprises use to authenticate employees and join Windows workloads such as EC2 and RDS, or to connect to an on-premises AD. It is not a customer identity service: it lacks user self-registration, hosted sign-in UI, social login, and MFA designed for your application's end-users. Even though it supports user authentication, it is scoped to workforce/directory domains, not consumer-facing app identities.
- ✗
AWS IAM Identity Center
Why it's wrong here
AWS IAM Identity Center (formerly AWS SSO) centralizes workforce identity and access across multiple AWS accounts and third-party SaaS applications, using an employee directory or SCIM provisioning. It focuses on single sign-on for employees, contractors, or federated corporate identities, not on managing sign-up, sign-in, and profile lifecycle for external application users. It has no user pools, no social identity provider login for your app, and no client-side mobile/web SDKs for consumer authentication, so it is the wrong service for app end-user identity.
- ✓
Amazon Cognito
Why this is correct
Amazon Cognito is the correct service for consumer-facing web and mobile app authentication. Cognito User Pools provide a fully managed user directory with sign-up and sign-in, a customizable hosted UI, multi-factor authentication, password resets, social login (Google, Facebook, Amazon), and SAML/OIDC federation. Cognito Identity Pools then issue temporary AWS credentials so your authenticated users can access AWS resources such as DynamoDB or S3 without embedding static keys. This combination directly addresses the question's need to identify add authenticate the users of an external application.
- ✗
AWS IAM
Why it's wrong here
AWS IAM is an access control and authorization service for AWS resources, not an end-user identity store for your own applications. IAM users, groups, and roles are primarily used by AWS account administrators and service principals to control who can call AWS APIs and which resources they can use. While IAM supports federation and can map external identities to IAM roles, it does not offer a user pool, self-service registration, app-hosted sign-in UI, or consumer social login, making it unsuitable as the identity system for your application's customers.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.