SAP-C02 · Question #853
A company stores a static website on Amazon S3. AWS Lambda functions retrieve content from an S3 bucket and serve the content as a website. An Application Load Balancer (ALB) directs incoming…
The correct answer is B. Create an S3 bucket policy that denies access to the S3 bucket if the aws:SecureTransport D. Set the origin protocol policy to HTTPS Only for CloudFront. F. Set the viewer protocol policy to Redirect HTTP to HTTPS for CloudFront. An S3 bucket policy using aws:SecureTransport blocks any accidental HTTP access to the bucket itself, ensuring objects are fetched only over HTTPS. Forces CloudFront to talk to the ALB over HTTPS, so the hop between CloudFront and your ALB Viewers who try HTTP get an automatic…
Question
A company stores a static website on Amazon S3. AWS Lambda functions retrieve content from an S3 bucket and serve the content as a website. An Application Load Balancer (ALB) directs incoming traffic to the Lambda functions. An Amazon CloudFront distribution routes requests to the ALB. The company has set up an AWS Certificate Manager (ACM) certificate on the HTTPS listener of the ALB. The company needs all users to communicate with the website through HTTPS. HTTP users must not receive an error. Which combination of steps will meet these requirements? (Choose three.)
Options
- AConfigure the ALB with a TCP listener on port 443 for passthrough to backend systems.
- BCreate an S3 bucket policy that denies access to the S3 bucket if the aws:SecureTransport
- CConfigure HTTP to HTTPS redirection on the S3 bucket.
- DSet the origin protocol policy to HTTPS Only for CloudFront.
- ESet the viewer protocol policy to HTTPS Only for CloudFront.
- FSet the viewer protocol policy to Redirect HTTP to HTTPS for CloudFront.
How the community answered
(40 responses)- A10% (4)
- B65% (26)
- C20% (8)
- E5% (2)
Explanation
An S3 bucket policy using aws:SecureTransport blocks any accidental HTTP access to the bucket itself, ensuring objects are fetched only over HTTPS. Forces CloudFront to talk to the ALB over HTTPS, so the hop between CloudFront and your ALB Viewers who try HTTP get an automatic 301 redirect to HTTPS instead of an error, satisfying the “must not receive an error” requirement.
Community Discussion
No community discussion yet for this question.