You are developing an application that is going to make use of AWS Cognito. The default sign-in and sign-up features of the AWS Cognito service will be used. There is a security requirement to ensure that if the user’s credentials are compromised, then they would need to use a new password. Which of the following needs to be in place for this? Choose 2 answers from the options given below.

Answer options:

A.Ensure to create a user pool in AWS Cognito.
B.Ensure to “Block use” for compromised credentials in the Advanced Security section.
C.Ensure to “Block use” for compromised credentials in the Basic Security section.
D.Verify sign-in operation on Cognito using Secure Remote Password.

Answer – A and B
This is given in the AWS Documentation.
Option C is incorrect since this configuration needs to be done in the Advanced Security section.
Option D is incorrect. Currently, Amazon Cognito doesn`t check for compromised credentials for sign-in operations with Secure Remote Password (SRP) flow, which doesn`t send the password during sign-in.
For more information on Cognito User pools, please refer to the below URL-
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-compromised-credentials.html