AWS Certified Solutions Architect CloudFront and Content Delivery 5 — Questions and Answers
Question 1: A company is migrating to a new CloudFront distribution but wants to gradually shift traffic from the old distribution to the new one. Which CloudFront feature supports this use case?
- CloudFront Origin Groups with weighted routing
- CloudFront Continuous Deployment with traffic weights (Correct answer)
- Route 53 weighted routing between two distributions
- Lambda@Edge for request-based routing
Correct answer: CloudFront Continuous Deployment with traffic weights
CloudFront Continuous Deployment allows you to create a staging distribution and gradually shift a percentage of traffic to it before promoting it to production.
Question 2: An architect needs to configure CloudFront to automatically failover to a secondary S3 bucket if the primary S3 bucket returns 5xx errors. What should they configure?
- AWS Global Accelerator with health checks
- CloudFront Origin Group with primary and secondary origins (Correct answer)
- Route 53 health checks with CloudFront
- Lambda@Edge to reroute failed requests
Correct answer: CloudFront Origin Group with primary and secondary origins
CloudFront Origin Groups allow you to define a primary and secondary origin; CloudFront automatically fails over to the secondary when the primary returns specified HTTP status codes.
Question 3: A solutions architect wants to analyze CloudFront access patterns in near real-time to detect anomalies. Which CloudFront feature delivers log data within seconds of viewer requests?
- CloudFront Standard Logs (S3)
- CloudFront Real-Time Logs (Kinesis Data Streams) (Correct answer)
- AWS CloudTrail with CloudFront
- VPC Flow Logs for CloudFront
Correct answer: CloudFront Real-Time Logs (Kinesis Data Streams)
CloudFront Real-Time Logs deliver log records to Amazon Kinesis Data Streams within seconds of viewer requests, enabling near real-time analysis.
Question 4: A company needs to serve their website through CloudFront using their own domain (www.example.com) with HTTPS. What are the TWO required components?
- An ACM certificate in us-east-1 and a CNAME/Alias DNS record pointing to the CloudFront domain (Correct answer)
- An ACM certificate in the same region as the origin and a Route 53 hosted zone
- An IAM certificate uploaded to CloudFront and an A record in Route 53
- An ACM certificate in us-west-2 and a CloudFront origin access identity
Correct answer: An ACM certificate in us-east-1 and a CNAME/Alias DNS record pointing to the CloudFront domain
CloudFront requires an ACM certificate provisioned in us-east-1 (N. Virginia) for custom SSL/TLS, plus a DNS CNAME or Route 53 Alias record pointing to the CloudFront distribution domain.
Question 5: A CloudFront distribution serves both static assets (images, CSS) and dynamic API calls. The architect wants to cache static assets for 1 year but never cache API responses. What is the correct configuration approach?
- Set a single default TTL of 0 and use Cache-Control headers on static assets only
- Create separate Cache Behaviors with different path patterns and TTL settings for each content type (Correct answer)
- Use two separate CloudFront distributions for static and dynamic content
- Configure Lambda@Edge to set TTL based on content type
Correct answer: Create separate Cache Behaviors with different path patterns and TTL settings for each content type
Multiple Cache Behaviors with path patterns (e.g., /api/* vs /static/*) allow different caching policies and TTLs to be applied to different content types within a single distribution.
Question 6: A financial services company requires that all connections to their CloudFront distribution use TLS 1.2 or higher for compliance. Where is this configured?
- In the origin's security group settings
- In the CloudFront distribution's Security Policy setting under Viewer Protocol Policy (Correct answer)
- In AWS WAF rules attached to the CloudFront distribution
- In ACM certificate settings when creating the certificate
Correct answer: In the CloudFront distribution's Security Policy setting under Viewer Protocol Policy
The CloudFront Security Policy setting controls the minimum TLS protocol version and cipher suites allowed for HTTPS connections between viewers and CloudFront.
Question 7: A company uses CloudFront to serve an S3-hosted website. They want to ensure S3 bucket content cannot be accessed directly via the S3 URL and only through CloudFront. What is the CURRENT recommended approach?
- Enable S3 Block Public Access and use Origin Access Control (OAC) with a bucket policy (Correct answer)
- Use an Origin Access Identity (OAI) and set the S3 bucket ACL to private
- Enable S3 server-side encryption and restrict access via CloudFront signed URLs only
- Configure an S3 bucket policy that only allows the CloudFront service principal IP ranges
Correct answer: Enable S3 Block Public Access and use Origin Access Control (OAC) with a bucket policy
Origin Access Control (OAC) is the current recommended method (replacing the legacy OAI) to restrict S3 access to CloudFront only, combined with a corresponding S3 bucket policy.
AWS Certified Solutions Architect CloudFront and Content Delivery 5
A company is migrating to a new CloudFront distribution but wants to gradually shift traffic from the old distribution to the new one.
Which CloudFront feature supports this use case?