DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a Cognito identity pool and enable the Google authentication provider, specifying the Google client ID.

  Why it's wrong here

  Cognito identity pools are used to grant AWS credentials to users, not to authenticate them. While identity pools can accept tokens from Google, they do not handle the sign-in flow. The developer needs a user pool to manage authentication and federation with Google, not just an identity pool.

• ✓

  Configure a Cognito user pool with a Google identity provider, providing the Google client ID and client secret.

  Why this is correct

  Amazon Cognito user pools support federation with social identity providers like Google. By configuring Google as an identity provider in the user pool, users can sign in with their Google accounts. The developer must supply the Google app's client ID and client secret, which Cognito uses to validate tokens during the federation process.

• ✗

  Implement a custom OAuth 2.0 flow in the application that directly calls the Google API and then issues AWS credentials.

  Why it's wrong here

  While custom OAuth is possible, it requires significant development effort and does not integrate with Cognito's user management features. Cognito user pools provide a managed, secure way to federate with Google, handling token validation and user profile mapping. Reinventing this flow is unnecessary and error-prone.

• ✗

  Use AWS IAM to create a role for Google users and attach a policy that allows access to the application.

  Why it's wrong here

  IAM roles are for AWS permissions, not for federating with Google authentication. Google users cannot directly assume IAM roles without a federation service like Cognito. This approach does not provide a sign-in mechanism and is not how social login is implemented.

Go deeper

Related to this question