Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A developer is building a mobile application that needs to allow users to sign up and sign in using email and password, and also allow them to sign in with social identity providers like Facebook. Which Amazon Cognito component should be used to manage the user sign-up and sign-in process?

   • AAWS IAM Identity Center
   • BCognito sync
   • CCognito identity pool
   • DCognito user pool
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An application uses Amazon Cognito user pools for authentication. After a user signs in successfully, the application needs to access AWS resources such as an S3 bucket. Which Cognito component should be used to exchange the user's authentication token for temporary AWS credentials?

   • AAWS STS
   • BCognito identity pool
   • CAWS IAM
   • DCognito user pool
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security engineer is designing a central authentication solution for a company's workforce. The company wants to use AWS IAM Identity Center to manage access to multiple AWS accounts and business applications. Which component of IAM Identity Center defines the level of access that a user or group receives when assigned to an AWS account?

   • APermission set
   • BIdentity source
   • CAWS account assignment
   • DService control policy
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A company wants to allow its employees to authenticate to AWS using their existing corporate Active Directory credentials. Which AWS service can be used to establish a trust relationship between the corporate IdP and AWS IAM for federated access?

   • AAWS STS
   • BAWS IAM Identity Center
   • CAWS Directory Service Simple AD
   • DAmazon Cognito user pools
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company runs a batch processing application on Amazon EC2 instances. The application needs to read from an S3 bucket and write to a DynamoDB table. The security team wants to avoid storing long-term credentials on the instances. Which authentication strategy should the company implement?

   • AGenerate a presigned URL for the S3 bucket and use it to access the objects, and use a service-linked role for DynamoDB.
   • BCreate an IAM role with the required permissions and attach it to the EC2 instance profile.
   • CCreate an IAM user with the required permissions and store the access key and secret key in the application's configuration file.
   • DUse an IAM role with a trust policy that allows the EC2 instance to assume it, and manually call AssumeRole from the application.
   Reveal Solution Discussion Select an answer first