Q8 — AWS SAA-C03 Ch.11

Question 8 of 100 | ← Chapter 11

Q708. A solutions architect is designing a user authentication solution for a company. The solution must invoke two-factor authentication for users that log in from inconsistent geographical locations, IP addresses. or devices. The solution must also be able to scale up to accommodate millions of users.Which solution will meet these requirements?

Correct Answer: A. Configure Amazon Cognito user pools for user authentication. Enable the risk-based adaptive authentication feature with multi-factor authentication (MFA)

Explanation

To meet the requirements of invoking two-factor authentication for users logging in from inconsistent geographical locations, IP addresses, or devices, and to accommodate millions of users, the solution that would best meet these requirements is:A. Configure Amazon Cognito user pools for user authentication. Enable the risk-based adaptive authentication feature with multi-factor authentication (MFA).Option A provides a comprehensive solution that meets the requirements of two-factor authentication for users based on inconsistent geographical locations, IP addresses, or devices, while also being scalable for millions of users:- Configure Amazon Cognito user pools: Amazon Cognito user pools provide a fully managed user directory for creating and managing user accounts. User pools handle user registration, authentication, and account recovery. They can scale to accommodate millions of users.- Enable the risk-based adaptive authentication feature: By enabling the risk-based adaptive authentication feature in Amazon Cognito user pools, you can configure rules that evaluate user sign-in attempts based on factors such as geographical location, IP address, or device. This allows you to trigger additional security measures, such as requiring multi-factor authentication (MFA), for users logging in from inconsistent locations or devices.- Enable multi-factor authentication (MFA): With Amazon Cognito user pools, you can easily enable MFA for user authentication. This adds an additional layer of security by requiring users to provide a second form of authentication, such as a code from an authenticator app, in addition to their regular password.Option B, configuring Amazon Cognito identity pools for user authentication and enabling MFA, does not provide the risk-based adaptive authentication feature needed to trigger MFA based on inconsistent geographical locations, IP addresses, or devices.Option C, configuring AWS Identity and Access Management (IAM) users and attaching an IAM policy for AllowManageOwnUserMFA, is not suitable for a scalable user authentication solution for millions of users. IAM users are typically used for managing access to AWS resources, and they do not provide the same level of user authentication features as Amazon Cognito user pools.Option D, configuring AWS IAM Identity Center (AWS Single Sign-On) authentication with permission sets that require MFA, is primarily focused on providing single sign-on capabilities and managing access to AWS accounts and applications. It does not provide the same level of user authentication features and scalability as Amazon Cognito user pools.Therefore, the best solution is A: Configure Amazon Cognito user pools for user authentication, enable the risk-based adaptive authentication feature with MFA. This solution provides the necessary features for two- factor authentication based on inconsistent geographical locations, IP addresses, or devices, and can scale up to accommodate millions of users.