DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Amazon Cognito user pools integrated with the Application Load Balancer

  Why this is correct

  Amazon Cognito User Pools can be seamlessly integrated with an Application Load Balancer (ALB) to offload user authentication for web and mobile applications. The ALB's authentication feature redirects unauthenticated requests to Cognito for sign-in, and upon successful authentication, Cognito returns a JSON Web Token (JWT). The ALB then validates this token and forwards the request to the backend EC2 instances, optionally injecting user claims as HTTP headers, which simplifies application development by centralizing user management and authentication.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  AWS Identity and Access Management (IAM) is designed for securely managing access to AWS services and resources for AWS users and applications, not for authenticating external mobile application users directly. While IAM can be used to grant temporary, fine-grained permissions to authenticated users (often via Cognito Identity Pools), it does not function as a general-purpose identity provider for application sign-up and sign-in workflows. Using IAM directly for mobile app user authentication would be an architectural mismatch and highly impractical.

• ✗

  Amazon API Gateway with a Lambda authorizer

  Why it's wrong here

  This option is incorrect because the problem statement specifies the REST API is running on Amazon EC2 instances behind an Application Load Balancer. Amazon API Gateway typically serves as the front door for APIs, abstracting the backend. Introducing API Gateway with a Lambda authorizer would mean fundamentally changing the existing architecture by placing API Gateway in front of the ALB, rather than enhancing the current setup. While a valid pattern for serverless APIs, it's not applicable when the backend is already established with EC2 and ALB.

• ✗

  Amazon CloudFront with Lambda@Edge

  Why it's wrong here

  Amazon CloudFront is a Content Delivery Network (CDN) primarily focused on accelerating content delivery and caching, not on managing user identities or performing full-fledged authentication. While Lambda@Edge functions can be used with CloudFront to perform basic request modifications or authorization checks at the edge, CloudFront itself does not provide a user directory or the comprehensive authentication features required for mobile app users. It cannot handle user sign-up, sign-in, or token management for a REST API's authentication layer.

Go deeper

Related to this question