Objectives in this domain

Implement application authentication and federated access using Amazon Cognito user pools and identity pools with SAML and OpenID Connect providers.
Section 2.1medium
Grant least-privilege application access using IAM roles and AWS STS temporary credentials rather than long-lived access keys.
Section 2.2medium
Author and reason about IAM identity-based and resource-based policies, including managed versus customer-managed policies and policy evaluation.
Section 2.3medium
Secure applications and APIs using bearer tokens such as JSON Web Tokens and OAuth, validated through API Gateway authorisers.
Section 2.4medium
Encrypt and decrypt application data with AWS KMS using customer managed keys, envelope encryption, key rotation and cross-account key access.
Section 2.5hard
Protect data in transit and at rest using TLS, AWS Certificate Manager and the correct choice between client-side and server-side encryption.
Section 2.6medium
Manage application secrets and configuration securely using AWS Secrets Manager and AWS Systems Manager Parameter Store with rotation and encrypted values.
Section 2.7medium
Handle sensitive data in application code through data classification, sanitisation and secure credential handling to protect PII and PHI.
Section 2.8medium

Sample question from this domain

Free sampleSecuritymedium

An iOS application authenticates users through an Amazon Cognito user pool and now needs each signed-in user to upload files straight to an Amazon S3 bucket from the device using the AWS SDK, scoped by an IAM role. The team does not want to embed any long-lived AWS access keys in the app. Which approach lets the device obtain temporary AWS credentials for these S3 calls?

AConfigure an Amazon Cognito identity pool that trusts the user pool, then exchange the user pool token for temporary AWS credentials from an assumed IAM role. Correct
BPass the user pool ID token directly to the AWS SDK for Amazon S3, because the SDK accepts a Cognito JWT as the signing credential for S3 requests.
CCreate an IAM user for the bucket and ship its access key and secret key inside the application bundle so the SDK can authorise each upload.
DAttach a bucket policy that grants the user pool group access, so any token issued by the user pool can call Amazon S3 without further credential exchange.

Use an Amazon Cognito identity pool to exchange a user pool token for temporary IAM role credentials so a device can call AWS services directly. A Cognito identity pool configured with the user pool as an authentication provider exchanges the validated user pool token for temporary credentials from an assumed IAM role through STS, and the AWS SDK then signs S3 calls with those rotating credentials rather than any embedded key.

Why A is correct: An identity pool trusts the user pool as an authentication provider and calls STS to return short-lived role credentials, which the SDK uses to sign the S3 requests with no stored keys.

Why B is wrong: The AWS SDK signs S3 requests with SigV4 access keys, not a raw JWT, so a user pool ID token cannot be used directly as the S3 signing credential.

Why C is wrong: Embedding a long-lived IAM access key in a distributed app exposes the secret to extraction and never rotates, which the requirement and least-privilege practice both forbid.

Why D is wrong: An S3 bucket policy authorises IAM principals, not user pool tokens, so it cannot let a Cognito JWT call S3 and does not produce the temporary credentials the SDK needs.

Other domains in this exam

Development with AWS Services32% of the exam
Deployment24% of the exam
Troubleshooting and Optimization18% of the exam

See also the DVA-C02 cert hub, the study guide, and the cheat sheet.