DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Obtain the IdP's metadata document to configure the trust.

  Why this is correct

  The IdP metadata document (SAML XML) supplies the IdP's SingleSignOnService endpoint and its X.509 signing certificate, which IAM and the Application Load Balancer require to validate SAML assertions. Fetching this document is a prerequisite: you cannot create the IAM SAML provider or the ALB authentication action without these values. This step establishes the cryptographic trust path between the corporate identity provider and the load balancer.

• ✓

  Register the corporate IdP as a SAML identity provider in IAM.

  Why this is correct

  IAM holds a SAML identity provider entity that stores the metadata document and issues an Amazon Resource Name (ARN) used by the ALB authentication action. Without registering the corporate IdP in IAM, the ALB has no trusted authority to redirect sign-in requests to or to parse SAML responses from. This registration is a distinct, mandatory configuration step that links the metadata document to the ALB rule.

• ✗

  Configure Amazon Cognito as an intermediary.

  Why it's wrong here

  Amazon Cognito is fully capable as an identity broker, but for this scenario it would be an extra hop in the authentication flow. ALB natively supports SAML federation when the IdP is registered in IAM, so Cognito is not required as an intermediary. Adding Cognito would introduce separate user pools/federated identity configuration, complicating the architecture without solving any requirement in the question stem.

• ✗

  Register the corporate IdP in Amazon Route 53.

  Why it's wrong here

  Amazon Route 53 is the DNS service; it resolves hostnames to IP addresses and provides traffic routing, health checks, and failover. You do not register a SAML identity provider in Route 53, and creating a record for the corporate IdP would give the load balancer an IP address, not a trust relationship or an authentication endpoint. This option misunderstands the role of Route 53 in the federation path.

• ✓

  Create an ALB rule that uses the SAML provider for authentication.

  Why this is correct

  The ALB listener rule with the authenticate action redirects unauthenticated requests to the corporate IdP discovery service and then processes the returned SAML response before forwarding to the target group. This rule references the IAM SAML provider ARN in the authenticate configuration, making it the final piece that ties the IdP registration to the actual traffic path. Without this rule, the load balancer would not know which requests require SAML authentication.

Go deeper

Related to this question