DVA-C02 Development with AWS Services Practice Question
A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application needs to authenticate users via an external OpenID Connect (OIDC) identity provider. The company wants to offload authentication to the load balancer and use IAM roles to access AWS resources. Which solution should the developer implement?
⚠ Common exam trap
Watch out — candidates often confuse target group configuration with listener rule authentication actions, or assume that Cognito is required for any OIDC integration with ALB, when in fact ALB natively supports external OIDC providers directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.
The Application Load Balancer (ALB) can directly authenticate users against an external OpenID Connect (OIDC) identity provider using its native OIDC authentication action. After successful authentication, the ALB passes the ID token to the backend application, which can then use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the token for temporary AWS credentials, allowing the application to access AWS resources via an IAM role without managing long-term keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the ALB target group to authenticate using the OIDC identity provider.
Why it's wrong here
Application Load Balancers (ALBs) handle user authentication at the listener rule level, not on the target group. Listener rules are configured with actions like `authenticate-oidc` to integrate with an OIDC identity provider before forwarding requests. Target groups are primarily responsible for routing requests to registered backend instances and performing health checks, making them an inappropriate place for user authentication configuration.
- ✗
Use AWS Lambda@Edge to authenticate users at the edge.
Why it's wrong here
AWS Lambda@Edge functions are specifically designed to run in conjunction with Amazon CloudFront distributions, allowing custom logic to be executed at AWS edge locations. While Lambda@Edge can perform authentication, it operates within the CloudFront ecosystem and is not directly integrated with or applicable to an Application Load Balancer (ALB) that is not fronted by CloudFront.
- ✓
Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.
Why this is correct
Application Load Balancers natively support authentication with OpenID Connect (OIDC) identity providers by configuring an `authenticate-oidc` action on a listener rule. After successful authentication, the ALB forwards the ID token to the backend application. The application can then use this OIDC identity token to securely assume an AWS IAM role via web identity federation, granting temporary, fine-grained permissions to access AWS resources without embedding long-lived credentials.
- ✗
Use Amazon Cognito user pools as the OIDC provider and integrate with ALB.
Why it's wrong here
While Amazon Cognito User Pools can indeed function as an OpenID Connect (OIDC) identity provider, integrating it directly with an ALB is not the most direct or necessary approach for OIDC authentication. The Application Load Balancer itself has native capabilities to integrate directly with any compliant OIDC identity provider, including third-party providers, without requiring an intermediary service like Cognito for the authentication flow.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.