A multimedia app will let guest users view sample content before they create accounts for full access. The company wants to identify users who already have accounts and also track how many guest users later register. Which combination of actions meets these needs? (Choose two.)

An Amazon Cognito identity pool allows you to grant temporary AWS credentials to both authenticated and unauthenticated users. Enabling unauthenticated identities provides a unique identity for guest users, allowing them to assume a role with limited permissions (e.g., access to sample content). When these guest users register, they become authenticated identities within the same identity pool, and their unique identity persists, enabling tracking and allowing them to assume a different role with broader permissions (e.g., full content access). Creating separate roles for authenticated and unauthenticated users ensures granular access control, with unauthenticated users accessing only sample content and authenticated users accessing all content. Incorrect options: Creating a Cognito user pool and configuring it to allow unauthenticated users is not the primary mechanism for managing unauthenticated access to AWS resources; identity pools are designed for this. User pools are for managing user directories. CloudFront is a content delivery network and does not directly manage user authentication or authorization for backend AWS services in this manner. Making sample content publicly accessible by default doesn't provide a mechanism to track guest users or seamlessly transition them to authenticated users with different permissions.