Exam AWS Certified Security - Specialty topic 1 question 165 discussion

C & E are right

I'll go with CE

CE are correct, though by saying " public-facing application " it implies it is available to the public..and if so using AD/ADFS won't work. Again, not the best worded question.

CE Use Cognito to authenticate web applications. Enable federation.

C and E are the right ones

C & E are correct. The clue for the AD component is 'accessing their AWS accounts'. For this they'd use SAML. If it was to access AWS services, then A, D or E would work.

Why not C and D?

C & E are the correct answers.

CE is the correct answer C - separate authentication mechanism for applications

C - as they mentioned seperate authentication is needed for web application. Here we can use Cognito E - ADFS and SAML

B&E are Correct!

Is it not B and E

... in case someone thought AD Connector could be used for application auth (like I did), here is why that won't work: https://aws.amazon.com/blogs/security/how-to-connect-your-on-premises-active-directory-to-aws-using-ad-connector/ It is a bit misleading because the question doesn't talk about users wanting to use social media Id providers like Google, Facebook, which normally appear in the question when Cognito is a right answer

C & E.