A company runs a Kubernetes cluster on AWS and wants to allow pods to access AWS services securely. Which AWS feature is designed to provide temporary credentials to workloads running in Amazon EKS?

IAM roles for service accounts (IRSA)

A web application uses Amazon Cognito user pools for authentication. Users can sign up and sign in, but when they attempt to sign in with a federated identity provider (IdP), they receive an error that the user is not confirmed. The application does not use a PreSignUp Lambda trigger. What is the most likely cause of this issue?

The federated IdP is not returning the required attributes, such as email, in the SAML assertion.

The user pool's app client is not configured with the correct callback URL for the federated IdP.

The user pool's MFA settings are requiring MFA for federated users, which is not supported.

The federated user is being created in the user pool but is not being auto-confirmed because the 'Allow Cognito to automatically confirm users' option is disabled.

AWSCertified Security - Specialty

Domain 4Objective 1

Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 6)

Part of the Content Domain 4: Identity and Access Management domain, which accounts for 20% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~14–23 in this domain), expect 7–12 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

11concepts

20%of the exam

11 Concepts in This Objective

IAM Identity Center for human authentication
Amazon Cognito for application authentication
MFA enforcement and configuration
Identity provider integration
System and application authentication mechanisms
AWS STS and temporary credentials
Amazon S3 presigned URLs
Troubleshooting authentication with CloudTrail
Troubleshooting Cognito authentication issues
Troubleshooting IAM Identity Center permission sets
Troubleshooting AWS Directory Service authentication

Questions 26–30

26foundation · easy
A developer wants to allow a user to download a private object from an Amazon S3 bucket for a limited time without making the object public. Which feature should be used?
Select an answer first
27foundation · easy
A security administrator needs to enforce multi-factor authentication (MFA) for all IAM users in an AWS account. Which IAM policy condition key can be used to require MFA for API calls?
Select an answer first
28foundation · easy
A user reports that they cannot sign in to the AWS Management Console using AWS IAM Identity Center. Which CloudTrail event type would contain information about the sign-in attempt?
Select an answer first
29foundation · easy
A company runs a Kubernetes cluster on AWS and wants to allow pods to access AWS services securely. Which AWS feature is designed to provide temporary credentials to workloads running in Amazon EKS?
Select an answer first
30application · medium
A web application uses Amazon Cognito user pools for authentication. Users can sign up and sign in, but when they attempt to sign in with a federated identity provider (IdP), they receive an error that the user is not confirmed. The application does not use a PreSignUp Lambda trigger. What is the most likely cause of this issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 4.1: Design, Implement, and Troubleshoot Authentication Strategies SCS-C03 Practice Questions (Page 6)

Questions 26–30

A developer wants to allow a user to download a private object from an Amazon S3 bucket for a limited time without making the object public. Which feature should be used?

A security administrator needs to enforce multi-factor authentication (MFA) for all IAM users in an AWS account. Which IAM policy condition key can be used to require MFA for API calls?

A user reports that they cannot sign in to the AWS Management Console using AWS IAM Identity Center. Which CloudTrail event type would contain information about the sign-in attempt?

A company runs a Kubernetes cluster on AWS and wants to allow pods to access AWS services securely. Which AWS feature is designed to provide temporary credentials to workloads running in Amazon EKS?

Keep studying — Content Domain 4: Identity and Access Management