SCS-C02 Identity and Access Management Practice Question
A developer needs to access AWS resources from a mobile app. Which AWS service allows the app to obtain temporary credentials for authenticated users?
⚠ Common exam trap
SCS-C02 often tests the distinction between Cognito user pools (authentication) and identity pools (authorization for AWS credentials), causing candidates to confuse the two and select user pools when temporary AWS credentials are required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Cognito identity pools (federated identities)
Amazon Cognito identity pools (federated identities) are specifically designed to provide temporary, scoped AWS credentials to authenticated and unauthenticated users. The identity pool exchanges a token from an identity provider (such as a Cognito user pool, social provider, or SAML) for temporary AWS credentials via AWS Security Token Service (STS). This allows mobile apps to directly access AWS services like S3 or DynamoDB without embedding long-term credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Cognito user pools
Why it's wrong here
Amazon Cognito user pools handle the authentication process, including user sign-up, sign-in, and token issuance (ID tokens and access tokens as JWTs). However, these tokens are only proof of identity; they do not contain any AWS credentials and cannot be used directly to sign API requests to AWS services like S3 or DynamoDB. To obtain temporary AWS credentials, an identity pool must be used to exchange those user pool tokens, which is the missing piece in this scenario.
- ✗
AWS IAM Identity Center (AWS SSO)
Why it's wrong here
AWS IAM Identity Center (AWS SSO) is built for workforce identity management, enabling users to sign in once and access multiple AWS accounts or SaaS applications via SAML or OIDC federation. It is not designed for embedded mobile app scenarios where an end user of an app needs scoped, temporary AWS credentials for a particular backend resource. Additionally, IAM Identity Center does not provide mobile SDKs or an API model tailored for direct credential acquisition from a native mobile application, unlike Cognito identity pools.
- ✓
Amazon Cognito identity pools (federated identities)
Why this is correct
Amazon Cognito identity pools (federated identities) are the correct choice because they are specifically built to trade identity tokens—from Cognito user pools, social IdPs, or custom OIDC providers—for temporary AWS credentials. Internally, this uses AWS Security Token Service (STS) actions like AssumeRoleWithWebIdentity, and the resulting credentials are automatically refreshed by the AWS mobile SDKs. They also support unauthenticated guest access when guest users need limited access. This maps the authenticated/unauth user to an IAM role with fine-grained permissions to AWS resources.
- ✗
AWS Key Management Service (AWS KMS)
Why it's wrong here
AWS Key Management Service (AWS KMS) is a service for creating and managing customer master keys (now called KMS keys) used for cryptographic operations like encryption and decryption. It does not issue temporary AWS credentials, nor does it have any concept of user identity or authentication for purposes of accessing arbitrary AWS services. Even to call KMS APIs, a caller must already possess valid AWS credentials obtained through another mechanism, so KMS is entirely orthogonal to the requirement of granting a mobile app access to AWS resources.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.