DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS IAM

  Why it's wrong here

  AWS Identity and Access Management (IAM) is primarily used for securely controlling access to AWS services and resources by AWS users, groups, and roles. It defines permissions for who can perform what actions on which AWS resources, making it unsuitable for managing the identities and authentication of external end-users for a custom web application. IAM is foundational for AWS account security, not for customer-facing application user authentication.

• ✓

  Amazon Cognito

  Why this is correct

  Amazon Cognito is the ideal service for managing user identities and authentication for web and mobile applications, offering highly scalable user directories through its User Pools feature. It handles user registration, sign-in, and account recovery, and can integrate with social identity providers or enterprise directories. Cognito provides robust authentication flows and token management, specifically designed for application end-users.

• ✗

  AWS Directory Service

  Why it's wrong here

  AWS Directory Service provides managed directory services, such as Microsoft Active Directory or Simple AD, primarily for integrating AWS workloads with existing on-premises directories or for managing users and groups within an AWS-hosted directory environment. It is designed for enterprise IT environments and machine authentication, not for the public-facing user authentication requirements of a typical web application. Its purpose is distinct from managing customer identities.

• ✗

  AWS Security Token Service (STS)

  Why it's wrong here

  AWS Security Token Service (STS) allows you to request temporary, limited-privilege credentials for AWS IAM users or for users authenticated by an identity provider. While STS is crucial for granting temporary access to AWS resources, it does not manage user identities or perform the initial authentication of end-users for a web application itself. It acts as a broker for temporary AWS access, not an identity provider for application users.