AWS Certified Solutions Architect CloudFront and Content Delivery 4 — Questions and Answers
Question 1: A company wants to restrict CloudFront content delivery so that only users in specific countries can access their streaming videos. Which CloudFront feature should they use?
- Origin Access Control
- Geographic Restrictions (Geo Blocking) (Correct answer)
- Signed URLs with IP whitelisting
- Lambda@Edge country filtering
Correct answer: Geographic Restrictions (Geo Blocking)
CloudFront Geographic Restrictions (Geo Blocking) allows you to whitelist or blacklist specific countries to control content access.
Question 2: An application uses CloudFront to serve dynamic API responses. The team notices that personalized API responses are being cached and served to wrong users. What is the BEST solution?
- Disable caching entirely for the distribution
- Configure Cache Behavior to forward the Authorization header and use it as a cache key (Correct answer)
- Switch to an Application Load Balancer instead
- Enable field-level encryption on all responses
Correct answer: Configure Cache Behavior to forward the Authorization header and use it as a cache key
Forwarding the Authorization header and including it in the cache key ensures each user's requests are cached and served separately.
Question 3: A media company needs to deliver large video files globally with the lowest possible latency. They also need to accelerate uploads from users worldwide. Which AWS service combination is BEST?
- CloudFront for downloads only, S3 Transfer Acceleration for uploads (Correct answer)
- CloudFront for both downloads and uploads using POST method caching
- Global Accelerator for downloads, S3 multipart upload for uploads
- CloudFront with Origin Shield for downloads, CloudFront for PUT/POST uploads
Correct answer: CloudFront for downloads only, S3 Transfer Acceleration for uploads
CloudFront is optimized for downloads/GET requests while S3 Transfer Acceleration uses CloudFront's edge network to accelerate uploads to S3.
Question 4: A CloudFront distribution is configured with an S3 origin. After updating objects in S3, users still receive old content. What is the MOST cost-effective way to immediately serve updated content?
- Delete and recreate the CloudFront distribution
- Create an invalidation for the specific file paths (Correct answer)
- Change the S3 bucket name and update the origin
- Reduce the CloudFront TTL to zero
Correct answer: Create an invalidation for the specific file paths
Creating an invalidation removes specified objects from CloudFront edge caches immediately, forcing the next request to fetch fresh content from the origin.
Question 5: Which CloudFront feature allows you to run code at edge locations to modify HTTP requests and responses without managing servers?
- CloudFront Functions and Lambda@Edge (Correct answer)
- CloudFront Origin Shield
- CloudFront Real-Time Logs
- CloudFront Field-Level Encryption
Correct answer: CloudFront Functions and Lambda@Edge
CloudFront Functions (for lightweight JS) and Lambda@Edge (for more complex Node.js/Python code) both enable serverless code execution at edge locations.
Question 6: A company needs to protect sensitive credit card numbers in transit through CloudFront before they reach the origin. The data should be encrypted so only specific backend services with the private key can decrypt it. Which feature addresses this?
- CloudFront HTTPS enforcement
- AWS WAF integration with CloudFront
- CloudFront Field-Level Encryption (Correct answer)
- CloudFront Origin Access Control with KMS
Correct answer: CloudFront Field-Level Encryption
Field-Level Encryption allows you to encrypt specific POST data fields at the edge using a public key, so only authorized services with the private key can decrypt them.
Question 7: A CloudFront distribution serves content from multiple origins. The solutions architect wants to reduce the load on origins and improve cache hit ratios for requests going to a specific regional origin. Which feature should be enabled?
- CloudFront Origin Failover
- CloudFront Origin Shield (Correct answer)
- CloudFront Continuous Deployment
- CloudFront Cache Compression
Correct answer: CloudFront Origin Shield
Origin Shield adds an additional caching layer between CloudFront edge locations and your origin, reducing origin requests and improving cache hit ratios.
AWS Certified Solutions Architect CloudFront and Content Delivery 4
A company wants to restrict CloudFront content delivery so that only users in specific countries can access their streaming videos.
Which CloudFront feature should they use?