SAA-C03 Q566 · Networking

Question

A company uses an Amazon CloudFront distribution to serve thousands of media files to users. The CloudFront distribution uses a private Amazon S3 bucket as an origin. A solutions architect must prevent users in specific countries from accessing the company's files. Which solution will meet these requirements in the MOST operationally-efficient way?

Accepted Answer

**Answer B: Configure geographic restrictions in CloudFront** directly and precisely meets every requirement:

1. **Requirement: Prevent users in specific countries** → CloudFront **geo-restriction** (also called geo-blocking) allows you to configure an allowlist or blocklist of countries. CloudFront uses a GeoIP database to determine the user's country based on their IP address and either serves the content or returns a 403 Forbidden response.

2. **Requirement: MOST operationally efficient** → Geo-restriction is a **built-in, native feature** of CloudFront. You simply toggle it on in the distribution settings and specify the countries. There is no code to write, no token management, no cookie logic, and no additional infrastructure. It's a declarative configuration — set it and forget it

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips