ANS-C01 · Question #224
A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all…
The correct answer is A. Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for. Explanation Option A is correct because AWS maintains a managed prefix list specifically for CloudFront edge node IP ranges, and adding this prefix list as an inbound rule to the ALB's security group enforces the restriction at the network layer without any manual IP management…
Question
A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application. Which solution will meet these requirements in the MOST operationally efficient way?
Options
- AAdd an inbound rule to the ALB's security group to allow the AWS managed prefix list for
- BAdd an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the
- CConfigure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the
- DAssociate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic
How the community answered
(21 responses)- A81% (17)
- B5% (1)
- C10% (2)
- D5% (1)
Explanation
Explanation
Option A is correct because AWS maintains a managed prefix list specifically for CloudFront edge node IP ranges, and adding this prefix list as an inbound rule to the ALB's security group enforces the restriction at the network layer without any manual IP management - AWS automatically updates the prefix list as CloudFront IP ranges change, making it the most operationally efficient solution.
Why the distractors are wrong:
- Option B (Network ACLs) is incorrect because network ACLs are stateless and managing CloudFront's constantly changing IP ranges manually in ACL rules would be operationally burdensome; also, the managed prefix list cannot be directly referenced in network ACLs.
- Option C (Custom HTTP header) operates at the application layer (Layer 7), not the network layer as the question requires, and it requires application-level logic to inspect headers.
- Option D (AWS WAF) also functions at the application layer (Layer 7), not the network layer, and WAF is a more complex and costly solution than simply updating a security group rule.
Memory Tip: Think "Prefix List = Painless" - whenever AWS offers a managed prefix list for a service (like CloudFront or S3), using it in a security group is almost always the most operationally efficient network-layer solution because AWS handles all IP updates automatically.
Topics
Community Discussion
No community discussion yet for this question.