SAA-C03 Design Secure Architectures Practice Question
A company is developing a mobile application that allows users to sign in using their social media accounts (e.g., Google or Facebook). After signing in, the application needs to obtain temporary AWS credentials to upload photos directly to an Amazon S3 bucket. Which service should the architect use?
⚠ Common exam trap
SAA-C03 often tests Cognito vs manual STS web identity federation, baiting candidates who know STS is the underlying mechanism but miss that Cognito is the managed, recommended service for social login.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito
Amazon Cognito provides identity pools that directly support social identity providers (Google, Facebook, Amazon, Apple) and exchange the resulting tokens for temporary, scoped AWS credentials via STS. This is the managed, recommended way to implement web identity federation for mobile apps without building the token-exchange flow yourself. Cognito user pools handle authentication, and identity pools handle AWS credential vending.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS IAM User with static access keys
Why it's wrong here
Using static IAM access keys in a mobile application is a severe security risk, as they can be extracted from the app binary. Temporary credentials should always be used for client-side applications to minimize the impact of credential compromise and avoid the need for hard-coding secrets.
- ✓
Amazon Cognito
Why this is correct
Amazon Cognito Identity Pools enable you to grant your users temporary, limited-privilege access to AWS resources. By federating with social providers, Cognito manages the exchange of identity tokens for AWS STS credentials, providing a secure and scalable way for mobile users to interact with AWS services directly.
- ✗
AWS Directory Service
Why it's wrong here
AWS Directory Service is used to connect AWS resources with an existing on-premises Microsoft Active Directory or to set up a new managed directory. It is not designed for social media identity federation or providing temporary credentials to mobile application users for direct S3 access.
- ✗
AWS Security Token Service (STS) with a manual web identity federation implementation
Why it's wrong here
While AWS STS is the underlying service that provides the temporary credentials, implementing web identity federation manually is complex and error-prone. Amazon Cognito is the recommended service as it abstracts this complexity and provides a managed, secure framework for handling social logins and credential issuance.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.