SAA-C03 Design Secure Architectures Practice Question
A company is building a mobile application that needs to authenticate users and allow them to upload photos directly to an Amazon S3 bucket. Which TWO Amazon Cognito components should be used to provide a secure and scalable solution?
⚠ Common exam trap
The trap is confusing User Pools (authentication) with Identity Pools (authorization/credential vending) — many candidates pick only one, but the question requires both because authentication alone doesn't grant S3 access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito User Pools to manage user registration and sign-in.
Option A is correct because Amazon Cognito User Pools provide a scalable, managed user directory that handles registration, sign-in, and token issuance (ID, access, and refresh tokens) for the mobile app's authentication layer. Option B is correct because Cognito Identity Pools exchange the User Pool token for temporary, scoped AWS credentials via AWS STS, allowing the app to upload photos directly to S3 without embedding long-term keys. Together they implement the standard authentication-plus-authorization pattern for mobile apps accessing AWS services. Option C (Cognito Sync) is a legacy data-synchronization service, not an authentication or credential-vending mechanism, and is not needed here. Option D (IAM Users per app user) is an anti-pattern for mobile apps because it requires distributing long-term credentials and does not scale. Option E (AWS Directory Service) is for integrating existing AD/ LDAP directories and does not provide the mobile-native sign-up/sign-in or temporary credential flow required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon Cognito User Pools to manage user registration and sign-in.
Why this is correct
User Pools act as a managed user directory that provides sign-up and sign-in options for app users. They support standard identity providers like Google and Facebook, as well as custom attributes, making them the ideal choice for managing the authentication layer of a modern mobile or web application.
- ✓
Amazon Cognito Identity Pools to provide temporary AWS credentials to users.
Why this is correct
Identity Pools allow you to create unique identities for your users and federate them with identity providers. Once a user is authenticated, the identity pool provides short-lived AWS credentials with specific permissions, enabling the app to securely upload files directly to S3 without exposing long-term secrets.
- ✗
Amazon Cognito Sync to synchronize user data across multiple devices.
Why it's wrong here
Amazon Cognito Sync is a legacy service used for synchronizing application-related user data across devices. While it is still available, AWS AppSync is now the recommended service for data synchronization. Neither service is primarily responsible for the core authentication or the provisioning of AWS credentials for S3 access.
- ✗
IAM Users for each mobile application user to control S3 access.
Why it's wrong here
Creating individual IAM users for each mobile application user is not scalable and is a security anti-pattern. IAM users are intended for long-term identities within an organization. For thousands or millions of app users, Cognito is the correct service to provide dynamic, temporary access to AWS resources.
- ✗
AWS Directory Service to integrate with an on-premises Active Directory.
Why it's wrong here
AWS Directory Service is used to connect AWS resources to an existing Active Directory. While this can be used for corporate authentication, it is not the standard or most efficient way to manage identities for a general-purpose mobile application that requires scalable user management and direct S3 access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.