Cognito

Question 1

Which AWS service represents an identity platform for web and mobile applications, providing a user directory, an authentication server, and an authorization service for OAuth 2.0 access tokens and AWS credentials?

Answer 1

Cognito

Question 2

Which AWS service is designed for authentication, authorization, and user management for web and mobile applications?

Answer 2

Cognito

Question 3

What are the two main components of Cognito for managing users and identities?

Answer 3

User Pools and Identity Pools

Question 4

What functionality is provided by Cognito User Pools?

Answer 4

They handle user sign-up, sign-in, JSON Web Token (JWT) generation, and user directory management

Question 5

Do Cognito User Pools allow access to AWS services?

Answer 5

No, they do not grant access to AWS services

Question 6

Which functionality is provided by Cognito User Pools?

Answer 6

• User directory management
• Sign-in, sign-up, including external IDPs
• Customizable web UI
• MFA and other security features

Question 7

What resources can be accessed using the JWT token from Cognito User Pools?

Answer 7

Self-managed server-based resources and API Gateway

Question 8

What is the core functionality provided by Cognito Identity Pools?

Answer 8

To provide temporary AWS credentials

Question 9

Which functionality is provided by Cognito Identity Pools?

Answer 9

• Grant unauthenticated identities direct access to AWS resources
• Enable Identity Federation by exchanging external IDP credentials (e.g., Google, Facebook, SAML 2.0, or User Pools) for temporary AWS credentials

Question 10

Where are IAM Roles for a Cognito Identity Pool configured?

Answer 10

Directly within the Identity Pool

Question 11

What types of IAM roles, at minimum, should be configured for a Cognito Identity Pool?

Answer 11

At a minimum two roles:
- One role for authenticated identities
- One for unauthenticated identities

Question 12

How does a Cognito Identity pool provide temporary AWS credentials?

Answer 12

1. User Pool JWT token or external IDP token passed to Identity Pool
2. Cognito assumes the IAM Role defined in the Identity Pool
3. Cognito generates temporary AWS Credentials, and returns them to the client
4. Client uses credentials to access AWS Services

Question 12

How are Cognito User Pools and Identity Pools typically used together?

Answer 12

User Pools handle user authentication and identity management, while Identity Pools exchange User Pool JWT tokens for temporary AWS credentials

Question 13

What is Web Identity Federation?

Answer 13

It’s the process of exchanging an IDP-provided token (e.g., Google, Facebook, or SAML) for AWS credentials

Question 14

How are multiple rules evaluated in an AWS Cognito Identity Pool for role mapping?

Answer 14

Rules are evaluated in sequential order, and the IAM role for the first matching rule is applied

Adding a CustomRoleArn attribute can modify this behavior

Question 15

Which AWS service provides cross-device syncing of user-related application data?

Answer 15

AWS Cognito Sync

Question 16

Which MFA options are supported by AWS Cognito?

Answer 16

• Time-based one-time (TOTP) password service
• SMS authentication code