SCS-C03 Identity and Access Management Practice Question
A company is building a mobile application that requires users to authenticate before accessing private data stored in Amazon S3 and Amazon DynamoDB. Which THREE components or features of Amazon Cognito should be used to implement this securely?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cognito User Pools to provide a sign-in and sign-up directory for the application users.
Amazon Cognito provides a robust framework for mobile and web authentication. User Pools handle the management of user identities (sign-up/sign-in), while Identity Pools (Federated Identities) provide the mechanism to exchange those identities for temporary AWS credentials. Together with IAM roles, they ensure secure, scoped access to AWS resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cognito User Pools to provide a sign-in and sign-up directory for the application users.
Why this is correct
User Pools act as your identity provider, managing the user directory, authentication, and security features like MFA and password policies. They issue JSON Web Tokens (JWTs) upon successful login, which are then used by the application to prove the user's identity to other services or backends.
- ✓
Cognito Identity Pools to exchange authentication tokens for temporary AWS credentials.
Why this is correct
Identity Pools allow you to authorize users to access AWS services. By providing a token from a User Pool (or another provider like Google/Facebook), the Identity Pool returns temporary AWS credentials via STS, associated with a specific IAM role that defines what the user can do.
- ✓
IAM roles with trust policies that allow the Cognito Identity Pool service principal to assume them.
Why this is correct
For an Identity Pool to provide credentials, it must assume an IAM role. The role's trust policy must specifically permit 'cognito-identity.amazonaws.com' to assume the role. This link ensures that the permissions granted to the mobile user are controlled and audited through standard IAM mechanisms.
- ✗
Cognito Sync to store all user files directly from the mobile device to the cloud.
Why it's wrong here
Cognito Sync is primarily used for syncing application preferences and small amounts of user data across devices, but it is not intended for storing large files or replacing S3. Furthermore, Cognito Sync is largely superseded by AWS AppSync for more modern and scalable data synchronization requirements.
- ✗
AWS Secrets Manager to store the Cognito User Pool Client Secret on the mobile device.
Why it's wrong here
Storing secrets on a mobile device is inherently insecure, and Secrets Manager is not intended for client-side use. User Pool client secrets are generally used for server-side applications. For mobile apps, a 'public client' without a secret is typically used to prevent the exposure of sensitive credentials in the binary.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.