DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Amazon Cognito identity pools

  Why this is correct

  Amazon Cognito identity pools are specifically designed to provide temporary, limited-privilege AWS credentials to users authenticated through various identity providers, including Cognito User Pools, social logins, or SAML. Upon successful authentication, an identity pool exchanges the user's token for a set of temporary AWS credentials, allowing mobile or web applications to directly access specified AWS services with fine-grained permissions defined by an associated IAM role. This mechanism ensures secure, temporary access without embedding long-lived credentials in client applications.

• ✗

  AWS root access keys

  Why it's wrong here

  AWS root access keys are permanent, highly privileged credentials that grant unrestricted access to all resources within an AWS account. Distributing these keys to authenticated users is an extreme security anti-pattern, as it bypasses all granular access controls and provides no mechanism for temporary credentials or user-specific permissions. They are explicitly designed for account management and should be protected with the utmost care, never used for application access or distributed.

• ✓

  IAM roles with scoped permissions

  Why this is correct

  IAM roles are a fundamental AWS security primitive for granting temporary, scoped permissions to entities that need to make AWS API calls, including applications, services, or federated users. When an authenticated user, often via an identity provider like Cognito or SAML, assumes an IAM role, they are granted temporary security credentials (access key ID, secret access key, and session token) with permissions defined by the role's policies. This approach ensures least privilege and eliminates the need to distribute long-term static credentials.

• ✗

  An unrestricted S3 bucket policy

  Why it's wrong here

  An unrestricted S3 bucket policy controls access specifically to an S3 bucket and its objects, not the distribution of general AWS credentials for other services. Furthermore, an "unrestricted" policy would grant anonymous or broad public access, which directly contradicts the requirement for securely distributing temporary credentials to authenticated users. Such a policy is a severe security vulnerability and does not facilitate the secure authentication and authorization pattern needed for application users.

Go deeper

Related to this question