Q77 — AWS SAA-C03 Ch.15

Question 77 of 100 | ← Chapter 15

Q1177. A company uses an Amazon CloudFront distribution to serve thousands of media files to users. The CloudFront distribution uses a private Amazon S3 bucket as an origin.A solutions architect must prevent users in specific countries from accessing the company's files.Which solution will meet these requirements in the MOST operationally-efficient way?

Correct Answer: B. Configure geographic restrictions in CloudFront.

Explanation

To prevent users in specific countries from accessing the company's files served via an Amazon CloudFront distribution with a private Amazon S3 bucket as the origin, the most operationally-efficient solution is B. Configure geographic restrictions in CloudFront.Analysis of Options:Option A: Require users to access the files by using CloudFront signed URLs Purpose: Signed URLs are used to restrict access to specific files or paths within a CloudFront distribution to users who have a valid signed URL.Limitation: While this can control access at a granular level, it does not inherently restrict access based on geographic location. You would need to implement additional logic (e.g., checking the user's IP address or using a third-party service) to enforce geographic restrictions, which increases operational complexity.Option B: Configure geographic restrictions in CloudFrontPurpose: CloudFront allows you to configure geographic restrictions to block or allow access to your content based on the country from which the request originates. Advantage: This is the most straightforward and operationally-efficient way to enforce geographic restrictions. You can easily configure a list of countries to block or allow in the CloudFront distribution settings without needing to modify the application logic or use additional services. Option C: Require users to access the files by using CloudFront signed cookies Purpose: Signed cookies are similar to signed URLs but are used to restrict access to multiple files or paths within a CloudFront distribution. They are typically used when you want to grant access to a set of files without requiring a unique URL for each file.Limitation: Like signed URLs, signed cookies do not inherently restrict access based on geographic location. Additional logic would be needed to enforce geographic restrictions, increasing operational complexity.Option D: Configure an origin access control (OAC) between CloudFront and the S3 bucket Purpose: OAC is used to secure the connection between CloudFront and an S3 bucket origin, ensuring that only CloudFront can access the S3 bucket.Limitation: While OAC is important for securing the origin, it does not provide any geographic restriction capabilities. It only controls access to the S3 bucket from CloudFront, not from users accessing the content through CloudFront.Conclusion:B. Configure geographic restrictions in CloudFront is the most operationally-efficient solution to prevent users in specific countries from accessing the company's files. It provides a straightforward way to enforce geographic restrictions without requiring additional logic or modifications to the application.