SCS-C03 · Question #60
A company runs a global ecommerce website using Amazon CloudFront. The company must block traffic from specific countries to comply with data regulations. Which solution will meet these requirements…
The correct answer is C. Use CloudFront geo restriction to deny the countries. Amazon CloudFront includes a built-in geo restriction feature that allows content to be allowed or denied based on the viewer's country. According to AWS Certified Security - Specialty documentation, CloudFront geo restriction is the most cost-effective method for country-based…
Question
A company runs a global ecommerce website using Amazon CloudFront. The company must block traffic from specific countries to comply with data regulations. Which solution will meet these requirements MOST cost-effectively?
Options
- AUse AWS WAF IP match rules.
- BUse AWS WAF geo match rules.
- CUse CloudFront geo restriction to deny the countries.
- DUse geolocation headers in CloudFront.
How the community answered
(29 responses)- A14% (4)
- B10% (3)
- C72% (21)
- D3% (1)
Explanation
Amazon CloudFront includes a built-in geo restriction feature that allows content to be allowed or denied based on the viewer's country. According to AWS Certified Security - Specialty documentation, CloudFront geo restriction is the most cost-effective method for country-based blocking because it does not require AWS WAF or additional rule processing. AWS WAF geo match rules incur additional cost and are more appropriate when advanced inspection or layered security controls are required. IP-based blocking is impractical due to frequent IP changes. Geolocation headers do not enforce access control. CloudFront geo restriction is evaluated at the edge and efficiently blocks disallowed countries with minimal latency and cost.
Topics
Community Discussion
No community discussion yet for this question.