Task 1: Implement Authentication And/or Authorization for Applications and AWS Services DVA-C02 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An application has a feature where only users with an 'admin' role can delete records. The application uses Amazon Cognito and receives a JWT after sign-in. Where should the developer check for the user's role to enforce this authorization rule?

   • AIn the 'aud' claim of the access token
   • BIn the IAM policy attached to the application's execution role
   • CIn the 'exp' claim of the ID token
   • DIn the 'cognito:groups' claim of the ID token
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An application issues bearer tokens to users. A user has been compromised, and the developer needs to immediately prevent the token from being used. What is the standard mechanism to achieve this?

   • AAdd the token to a revocation list (denylist) and check it on every request
   • BChange the application's signing key, which will invalidate all tokens
   • CWait for the token to expire naturally, as there is no way to revoke it
   • DDelete the user's account from the application's database
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A developer is building a multi-tenant application where users can only access their own data. The application uses Amazon Cognito for authentication. What is the recommended way to implement this fine-grained authorization at the application level?

   • AUse the Cognito user pool's 'custom' attributes to store the user's data
   • BUse the 'sub' claim from the Cognito ID token to filter data by the user's unique identifier
   • CStore the user's password in the session and use it to query the database
   • DUse the IAM role attached to the application's EC2 instance to determine user access
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A developer is using the AWS CLI to make a call to an AWS service. The CLI is configured with an IAM user's access key and secret key. What does the CLI do with these credentials to authenticate the request?

   • AIt encrypts the credentials and sends them in the request body
   • BIt sends the credentials to the AWS STS service to get a session token
   • CIt uses the credentials to sign the request with Signature Version 4 (SigV4)
   • DIt sends the access key and secret key in the query string of the request
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company uses an on-premises Active Directory and wants to give its employees access to AWS resources via the AWS Management Console. The security team wants to enforce MFA and also map AD groups to IAM roles. Which solution should they implement?

   • ACreate an IAM identity provider for Active Directory and use the AWS CLI with SAML assertions.
   • BUse Amazon Cognito user pools with AD federation and assign IAM roles to users.
   • CSet up AWS IAM Identity Center (successor to AWS SSO) with an AD connector and assign permission sets to AD groups.
   • DCreate IAM users for each employee and enable MFA on each account.
   Reveal Solution Discussion Select an answer first