Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 150 discussion

A - is correct. https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html B - is correct. https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html#user-pool-waf-setting-up

To meet the requirements, the security team should choose Option A and Option B: A. Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool. This allows the team to perform custom validation during the sign-up process. The Lambda function can include logic to check the geographic location of the sign-up request and accept or deny it based on whether it originates from France. B. Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool. This adds an additional layer of security by using AWS WAF to block sign-up requests from outside France before they reach the Cognito user pool.

A and B are correct: -A: AWS documentation explains that you can use pre sign-up Lambda triggers to perform custom validation on user sign-ups. This allows you to accept or deny registration requests based on specific criteria, such as the geographic location of the user. - B: AWS WAF allows you to configure rules that can block requests from specific geographic locations. By associating an AWS WAF web ACL with the Amazon Cognito user pool, you can block sign-up requests from users outside of France.

Create a pre sign-up AWS Lambda trigger: By associating an Amazon Cognito function with the user pool using a pre sign-up Lambda trigger, you can perform custom validation. This trigger allows you to accept or deny the registration request based on the results of your validation1. Update the application’s Amazon Cognito user pool: Configure a geographic restriction setting within the user pool. This way, you can limit sign-ups to users from specific regions (in this case, France) and prevent fraudulent registrations from outside the expected location1. https://pupuweb.com/aws-certified-security-specialty-qa-combination-steps-perform-custom-validation-sign-up/

A, C correct

The correct answers are A and D. A: Creating a pre sign-up AWS Lambda trigger and associating it with the Amazon Cognito user pool will allow the security team to perform custom validation at sign-up. This Lambda function can be used to check the geographic location of the sign-up request and accept or deny the request based on whether it comes from France. D: Updating the application’s Amazon Cognito user pool to configure a geographic restriction setting will help to ensure that only users from France can sign up for the application. This setting can be used to block sign-up requests that come from outside of France. This is a straightforward way to prevent fraudulent sign-ups from users outside of France. However, it’s important to note that this method might not be 100% effective if the fraudulent users are using VPNs or other methods to appear as though they are in France. Therefore, it’s a good idea to also use the Lambda trigger for additional validation.