SAP-C02 Design for New Solutions Practice Question
A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?
⚠ Common exam trap
Many candidates confuse the ability to call STS directly with the need for pre-existing credentials; STS cannot issue temporary credentials without first authenticating the caller, so a mobile app without embedded credentials must use a service like Cognito to broker the token exchange.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon Cognito with an identity pool to issue temporary credentials.
Amazon Cognito identity pools are designed to provide temporary, limited-privilege AWS credentials to mobile app users. The service authenticates users through a public identity provider (e.g., Amazon, Facebook, Google, or a custom OIDC provider) and then exchanges the resulting identity token for temporary AWS credentials via the AWS Security Token Service (STS). This approach avoids embedding long-term credentials in the mobile app and enforces least-privilege access through IAM roles associated with the identity pool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create IAM users for each mobile user and distribute access keys.
Why it's wrong here
Not scalable or secure.
- ✗
Use AWS Security Token Service (STS) directly from the mobile app.
Why it's wrong here
Mobile app cannot call STS without AWS credentials.
- ✗
Create an IAM role and have the mobile app assume it directly.
Why it's wrong here
Mobile apps cannot assume roles without AWS credentials.
- ✓
Use Amazon Cognito with an identity pool to issue temporary credentials.
Why this is correct
Cognito Identity Pools are designed for this purpose.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.