Q88 — AWS SAA-C03 Ch.16

Question 88 of 100 | ← Chapter 16

Q1288. A company is designing a stock trading application that provides trading insights to customers. The company needs a solution to revoke access for inactive users who have not logged in to the application for over 180 days.Which solution will meet this requirement?

Correct Answer: B. Use Amazon Cognito to authenticate users. Store user login date and time from AWS CloudTrail events in Amazon DynamoDB. Schedule an Amazon EventBridge event to invoke an AWS Lambda function every day to deactivate users whose last login date is more than 180 days in the past.

Explanation

The correct solution must automatically revoke access for inactive users (those who haven't logged in for 180+ days) with minimal operational overhead and reliable tracking of last login times. Let's evaluate each option:Correct Answer: B. Use Amazon Cognito to authenticate users. Store user login date and time from AWS CloudTrail events in Amazon DynamoDB. Schedule an Amazon EventBridge event to invoke an AWS Lambda function every day to deactivate users whose last login date is more than 180 days in the past.Why Option B is Best:Native AWS Integration for Authentication & Logging:Amazon Cognito is the best choice for user authentication in AWS (supports OAuth, OIDC, and SAML). AWS CloudTrail automatically logs Cognito API calls (e.g., AdminInitiateAuth), which can be parsed to extract last login timestamps.Efficient & Scalable Storage:Amazon DynamoDB is a serverless NoSQL database that scales automatically and supports fast queries for last login times.Automated Deactivation with EventBridge & Lambda:Amazon EventBridge can trigger a Lambda function daily to scan DynamoDB for inactive users. Lambda can call Cognito's AdminDisableUser API to revoke access.No manual intervention required (fully automated).Low Operational Overhead:No need for Glue, Athena, or custom crawlers (unlike Options A/C/D). Cost-effective (DynamoDB + Lambda + EventBridge are serverless and pay-per-use).Why Other Options Fail:A. Use an OpenID Connect (OIDC) provider to authenticate users. Store user login metadata in Amazon RDS. Create an AWS Glue DataBrew job that checks a user's last login time and disables the user record if the last login date is more than 180 days in the past.Unnecessarily Complex & Costly:RDS requires manual scaling, patching, and backups (higher overhead than DynamoDB). Glue DataBrew is for data transformation, not scheduled user deactivation (overkill for this use case). No native integration with Cognito for deactivation (requires custom logic). C. Use Amazon Cognito to authenticate users. Store user login metadata in Amazon DocumentDB (with MongoDB compatibility). Define a TTL of 180 days for the sign-in time attribute. Configure an AWS Glue crawler to check users who have an expired TTL for login date and to invoke an AWS Lambda function to deactivate the users.Inefficient & Unreliable TTL Handling:DocumentDB TTL deletes documents automatically, but does not trigger Lambda (requires an external process to detect deletions).Glue crawlers are slow and expensive for real-time or daily checks. Better to query DynamoDB directly with EventBridge + Lambda (more reliable). D. Use a Kerberos-based identity provider (IdP) to authenticate users. Store user login metadata in an encrypted Amazon S3 bucket. Configure an AWS Glue crawler to catalog the user login metadata. Use Amazon Athena to query the data catalog for last login details. Delete data that is older than 180 days.Wrong Toolchain for the Job:Kerberos is not ideal for web-based stock trading apps (Cognito/OIDC is better). S3 + Glue + Athena is for analytics, not real-time user management (high latency, high cost). Deleting S3 records doesn't revoke Cognito access (requires separate API calls).Key Comparison:RequirementOption BOther OptionsAutomated deactivation of inactive users(EventBridge + Lambda + Cognito API) (A: Glue DataBrew; C:Unreliable TTL; D: No direct deactivation)Scalable & low-latency storage for login metadata(DynamoDB) (A: RDS; C: DocumentDB + Glue; D: S3 + Athena)Native AWS integration (no custom parsing)(CloudTrail + Cognito) (A: OIDC + RDS; C: DocumentDB TTL;D: Kerberos + S3)Least operational overhead(Fully serverless) (A: RDS management; C: Glue crawlers; D: S3 + Athena)Conclusion:Option B is the only solution that:Uses Cognito for authentication (best practice for AWS apps). Tracks last login times efficiently (CloudTrail + DynamoDB).Automates deactivation (EventBridge + Lambda).Requires minimal maintenance (serverless components).Final Answer: B