SAP-C02 Design for New Solutions Practice Question
A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The company wants to secure the API by requiring authentication via a JSON Web Token (JWT). Which service should the company use to manage user authentication and issue JWTs?
⚠ Common exam trap
Watch out — candidates often confuse AWS STS (which issues temporary AWS credentials) with a service that issues JWTs for application users, leading them to select STS instead of Cognito User Pools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito User Pools
Amazon Cognito User Pools is the correct choice because it is a fully managed identity provider that handles user sign-up, sign-in, and issues JSON Web Tokens (JWTs) for authentication. It integrates directly with API Gateway Lambda authorizers to validate JWTs and control access to API endpoints without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon Cognito User Pools
Why this is correct
Cognito User Pools provides authentication and JWT issuance for application users.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager stores secrets, not authentication tokens.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
IAM manages AWS users and roles, not application authentication.
- ✗
AWS Security Token Service (STS)
Why it's wrong here
STS issues temporary AWS credentials, not JWTs for application users.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.