DVA-C02 Development with AWS Services Practice Question
A developer is building a web application that requires user authentication. The application will run on Amazon EC2 instances behind an Application Load Balancer. The developer wants to offload authentication to a managed service that supports social login providers. Which AWS service should the developer use?
⚠ Common exam trap
Many candidates confuse IAM's role-based access control with user authentication, overlooking that IAM cannot handle social login providers or external user identity federation for customer-facing apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito
Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications, providing user authentication, authorization, and support for social login providers (e.g., Google, Facebook, Amazon) via OAuth 2.0 and OpenID Connect. It offloads the entire authentication workflow from the EC2 instances and ALB, integrating seamlessly with the ALB's authentication action to validate tokens before traffic reaches the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
AWS Identity and Access Management (IAM) is a foundational AWS service primarily used to securely control access to AWS services and resources. It allows you to manage AWS users, groups, roles, and their permissions, defining who can perform specific actions within your AWS environment. However, IAM is not designed for managing authentication for external end-users of a custom web application, nor does it natively support social identity providers for customer logins.
- ✓
Amazon Cognito
Why this is correct
Amazon Cognito is the correct choice because it is specifically engineered to provide secure and scalable user directories for web and mobile applications. Cognito User Pools enable easy sign-up, sign-in, and access control for application users, supporting multi-factor authentication and integration with social identity providers like Google, Facebook, and Apple. It offloads the complexity of user management and authentication from your application backend.
- ✗
AWS Directory Service
Why it's wrong here
AWS Directory Service provides managed Microsoft Active Directory or connects your AWS resources to an existing on-premises Active Directory. Its primary function is to enable enterprise users to access AWS services and applications using their existing corporate credentials, facilitating hybrid cloud environments. It is not designed for public-facing web application user authentication, nor does it support direct integration with social login providers for end-users.
- ✗
AWS Single Sign-On
Why it's wrong here
AWS IAM Identity Center (formerly AWS Single Sign-On) centralizes access management for multiple AWS accounts and business applications, primarily for enterprise employees. It simplifies the process of granting users access to various AWS accounts and integrated SaaS applications from a single identity source. This service is not intended for managing authentication for external customers of a web application or integrating with social identity providers for public user sign-ups.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.