Amazon Cognito User Pools is the correct choice because it provides a fully managed user directory with built in sign up and sign in flows and it minimizes custom development while supporting large scale consumer registrations.

Amazon Cognito User Pools handles user registration, password policies, email and phone verification, multi factor authentication and federation with social and OIDC identity providers while integrating with mobile SDKs and scaling to millions of users so the development team can focus on the app instead of building authentication plumbing.

Amazon Cognito Identity Pools is not correct because it issues temporary AWS credentials for accessing AWS resources and does not itself provide user registration or profile management.

Build a custom authentication service with AWS Lambda and Amazon DynamoDB would satisfy functionality but it increases development effort, operational burden and security responsibility which contradicts the requirement for a fully managed, low maintenance solution.

AWS Directory Service for Microsoft Active Directory targets enterprise directory and Windows integrated workloads inside a VPC and is not suited for public consumer mobile app sign up at internet scale.

Full AWS Practitioner Certification Question