SAA-C03 · Question #344
A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer…
The correct answer is C. Configure a CloudFront field-level encryption profile. Field-level encryption in Amazon CloudFront provides end-to-end encryption for specific data fields (e.g., credit card numbers, social security numbers). It ensures that sensitive fields are encrypted at the edge before being forwarded to the origin, and only the authorized…
Question
A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer of security. The sensitive information should be protected throughout the entire application stack, and access to the information should be restricted to certain applications. Which action should the solutions architect take?
Options
- AConfigure a CloudFront signed URL.
- BConfigure a CloudFront signed cookie.
- CConfigure a CloudFront field-level encryption profile.
- DConfigure CloudFront and set the Origin Protocol Policy setting to HTTPS Only for the Viewer
How the community answered
(22 responses)- B5% (1)
- C91% (20)
- D5% (1)
Explanation
Field-level encryption in Amazon CloudFront provides end-to-end encryption for specific data fields (e.g., credit card numbers, social security numbers). It ensures that sensitive fields are encrypted at the edge before being forwarded to the origin, and only the authorized application with the private key can decrypt them. This adds a layer of protection beyond HTTPS, which encrypts the whole payload but not individual fields. Signed URLs and cookies are for access control, not encryption. Setting HTTPS Only is a good practice but does not satisfy the field-specific encryption requirement.
Community Discussion
No community discussion yet for this question.