CLF-C02 Security and Compliance Practice Question
A development team is building a mobile application and needs to add user registration, sign-in, and authentication (including social login via Google and Facebook) without building and managing their own authentication backend. Which AWS service provides managed user authentication for applications?
⚠ Common exam trap
Test-takers frequently confuse AWS IAM with user authentication for applications, but IAM is strictly for AWS resource access control, not for end-user identity management in custom apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito
Amazon Cognito is the correct choice because it provides a fully managed user identity and authentication service specifically designed for mobile and web applications. It supports user registration, sign-in, and social login via identity providers like Google and Facebook through its user pools and identity pools features, eliminating the need to build and manage a custom authentication backend.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS IAM
Why it's wrong here
AWS IAM is an identity and access management service for controlling access to AWS resources and APIs, not for authenticating end users of a custom application. While IAM can issue temporary credentials for AWS services, it is designed for principals like IAM users, roles, and federated identities that map to AWS accounts, not for managing application-specific user directories. Using IAM for app users would require creating an IAM user per customer, which is unscalable and leaks AWS account structure. Cognito User Pools are the correct service for customer-facing application authentication because they provide a standalone user directory and sign-in flows.
- ✗
AWS Directory Service
Why it's wrong here
AWS Directory Service offers managed Microsoft Active Directory or Simple AD domains, intended for enterprise workloads that require LDAP, Kerberos, or Windows-integrated authentication. It is not designed as a customer identity store for web or mobile applications, and integrating it with a consumer app would require building custom federation or proxy logic. Cognito User Pools instead natively support user registration, sign-in, MFA, and social identity federation, making them the appropriate choice for application user authentication. Directory Service is more suited for internal, domain-joined workloads rather than broad public-facing app auth.
- ✓
Amazon Cognito
Why this is correct
Amazon Cognito User Pools provide a fully managed identity service specifically for application users, handling sign-up, sign-in, password reset, and MFA without requiring custom backend code. They support federation with social identity providers like Google and Facebook, as well as enterprise SAML or OIDC providers, and can issue JWTs for API authorization. Cognito also offers pre-built UI components and SDKs for mobile and web apps, and it scales to millions of users. This makes it the correct service for authenticating end users of an application, exactly matching the question's scenario.
- ✗
AWS SSO
Why it's wrong here
AWS IAM Identity Center (formerly AWS SSO) is built for workforce identity and single sign-on across AWS accounts and business applications, not for authenticating external application customers. It centralizes access for employees, contractors, and roles using an identity provider like Okta or Azure AD, and it grants AWS console or CLI access. Using it for a customer-facing app would force you to manage external users in a workforce directory, which is not its intended purpose. Cognito User Pools are the service designed for customer identity and access management (CIAM), which is why SSO is incorrect here.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.