nerdexam
Amazon

DVA-C02 · Question #254

A developer created a web API that receives requests by using an internet-facing Application Load Balancer (ALB) with an HTTPS listener. The developer configures an Amazon Cognito user pool and…

The correct answer is B. Create an authentication action for the listener rules of the ALSet the rule action type to. ALB natively supports Amazon Cognito user pool authentication as a listener rule action, allowing every request to be authenticated before reaching the backend targets.

Submitted by neha2k· Mar 5, 2026Development with AWS Services

Question

A developer created a web API that receives requests by using an internet-facing Application Load Balancer (ALB) with an HTTPS listener. The developer configures an Amazon Cognito user pool and wants to ensure that every request to the API is authenticated through Amazon Cognito. What should the developer do to meet this requirement?

Options

  • AAdd a listener rule to the listener to return a fixed response if the Authorization header is missing.
  • BCreate an authentication action for the listener rules of the ALSet the rule action type to
  • CCreate an Amazon API Gateway API. Configure all API methods to be forwarded to the ALB
  • DCreate a new target group that includes an AWS Lambda function target that validates the

How the community answered

(25 responses)
  • A
    12% (3)
  • B
    80% (20)
  • C
    4% (1)
  • D
    4% (1)

Why each option

ALB natively supports Amazon Cognito user pool authentication as a listener rule action, allowing every request to be authenticated before reaching the backend targets.

AAdd a listener rule to the listener to return a fixed response if the Authorization header is missing.

A fixed response rule can reject requests missing the Authorization header but cannot perform actual Cognito authentication or token validation.

BCreate an authentication action for the listener rules of the ALSet the rule action type toCorrect

Application Load Balancer supports an `authenticate-cognito` action type in listener rules. When configured, the ALB intercepts unauthenticated requests, redirects users to the Cognito hosted UI for login, validates the returned JWT token, and only forwards authenticated requests to the target group. This provides centralized authentication without modifying the backend application.

CCreate an Amazon API Gateway API. Configure all API methods to be forwarded to the ALB

Adding API Gateway in front of the ALB adds unnecessary architectural complexity when ALB already natively supports Cognito integration.

DCreate a new target group that includes an AWS Lambda function target that validates the

A Lambda function target for validation would work functionally but is operationally inefficient compared to the built-in ALB Cognito authentication action.

Concept tested: ALB Cognito user pool authentication action

Source: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DVA-C02 Practice