SAA-C03 Q194 · Security

Question

A company plans to deploy an application that uses an Amazon CloudFront distribution. The company will set an Application Load Balancer (ALB) as the origin for the distribution. The company wants to ensure that users access the ALB only through the CloudFront distribution. The company plans to deploy the solution in a new VPC. Which solution will meet these requirements?

Accepted Answer

**Answer C: Security group allowing only CloudFront edge location IPs**

**Step-by-step reasoning:**

1. **Requirement**: Users must only access the ALB through CloudFront, not directly.

2. **How it works**: AWS publishes the IP ranges of all CloudFront edge locations in its public IP ranges JSON file (ip-ranges.json). You can create a security group that allows inbound HTTP/HTTPS traffic ONLY from these CloudFront IP prefixes.

3. **AWS Managed Prefix List**: AWS provides a managed prefix list (`com.amazonaws.global.cloudfront.origin-facing`) specifically for CloudFront origin-facing IPs. You can reference this prefix list directly in security group rules instead of manually maintaining IP ranges.

4. **Effectiveness**: When associated with the ALB, this security group blocks any direct

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips