SAP-C02 · Question #200
A company is launching a web-based application in multiple regions around the world. The application consists of both static content stored in a private Amazon S3 bucket and dynamic content hosted…
The correct answer is A. Create a web ACL in AWS WAF with a rule to validate the presence of a custom header and C. Configure CloudFront to add a custom header to origin requests. F. Create a CloudFront Origin Access Identity (OAI) and add it to the CloudFront distribution. Update. Use CloudFront to add a custom header to all origin requests. Using AWS WAF, create a web rule that denies all requests without this custom header. Associate the web ACL to the CloudFront distribution is incorrect. If any new requests are going to CloudFront, they won't have…
Question
A company is launching a web-based application in multiple regions around the world. The application consists of both static content stored in a private Amazon S3 bucket and dynamic content hosted in Amazon ECS containers content behind an Application Load Balancer (ALB). The company requires that the static and dynamic application content be accessible through Amazon CloudFront only. Which combination of steps should a solutions architect recommend to restrict direct content access to CloudFront? (Choose three.)
Options
- ACreate a web ACL in AWS WAF with a rule to validate the presence of a custom header and
- BCreate a web ACL in AWS WAF with a rule to validate the presence of a custom header and
- CConfigure CloudFront to add a custom header to origin requests.
- DConfigure the ALB to add a custom header to http requests.
- EUpdate the S3 bucket ACL to allow access from the CloudFront distribution only.
- FCreate a CloudFront Origin Access Identity (OAI) and add it to the CloudFront distribution. Update
How the community answered
(28 responses)- A61% (17)
- B7% (2)
- D11% (3)
- E21% (6)
Explanation
Use CloudFront to add a custom header to all origin requests. Using AWS WAF, create a web rule that denies all requests without this custom header. Associate the web ACL to the CloudFront distribution is incorrect. If any new requests are going to CloudFront, they won't have the custom header initially so AWS WAF may block the request immediately. This could deny any new connections to CloudFront. Therefore, you need to associate the web ACL to the ALB, which is after the CloudFront adds the custom header.
Community Discussion
No community discussion yet for this question.