Examkin

Question

Difficulty: MediumAmazon CloudFront Caching, Origins, and Security

An application's frontend is distributed globally using an Amazon CloudFront distribution, with an Application Load Balancer (ALB) configured as the origin. A SysOps administrator needs to configure the apex domain (example.com) to route traffic to the CloudFront distribution. The administrator also wants to secure the origin by restricting direct public access to the ALB while ensuring client-to-ALB communication functions correctly. Which configuration correctly satisfies these routing and security requirements?

  1. Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the ALB security group to allow inbound HTTPS traffic from the CloudFront IP ranges, and ensure outbound rules allow responses to return to CloudFront.Answer
  2. B
    Create an Amazon Route 53 CNAME record at the zone apex pointing to the CloudFront distribution domain name. Configure the ALB security group to allow inbound HTTPS traffic from the CloudFront IP ranges.
  3. C
    Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the stateless Network Access Control List (NACL) for the ALB subnets to allow inbound traffic from the CloudFront IP ranges on port 443, but block outbound traffic on ephemeral ports (1024-65535) to prevent unauthorized outbound connections.
  4. D
    Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution. Configure the ALB target group health check port to require client-side SSL/TLS certificate authentication from CloudFront to verify origin integrity.

Answer

Create an Amazon Route 53 Alias record at the zone apex pointing to the CloudFront distribution, configure the ALB security group to allow inbound HTTPS traffic from CloudFront IP ranges, and ensure outbound rules allow responses to return to CloudFront.
The correct configuration uses a Route 53 Alias record to map the zone apex to the CloudFront distribution domain, resolving the DNS limitation of CNAME records. To secure the origin, the ALB's security group limits inbound traffic to CloudFront's IP ranges. Because security groups are stateful, return traffic is automatically allowed.

Step-by-Step Solution

1
Select the correct DNS record type for the zone apex.
Identify that an Alias record, rather than a CNAME record, is required at the zone apex (example.com) to point to the CloudFront distribution.
DNS protocol specifications (RFC 1035) prohibit CNAME records at the zone apex because other records (like SOA and NS) must exist there, whereas Route 53 Alias records bypass this limitation.
2
Configure origin security and traffic flow control.
Ensure that the ALB's security group allows inbound HTTPS (port 443) traffic from CloudFront's IP address ranges.
Restricting the ALB's ingress to CloudFront IP ranges prevents clients from bypassing the CloudFront distribution and accessing the ALB directly.
3
Ensure return traffic is permitted through stateful and stateless firewalls.
Verify that return traffic is not blocked by stateless NACLs or stateful security group rules.
Security groups are stateful and automatically track connections, whereas stateless NACLs require explicit rules allowing outbound ephemeral ports (1024-65535) for response traffic.

Key Concept

Configuring CloudFront with an ALB origin requires combining DNS Alias records at the zone apex with correct security group and NACL configurations to ensure safe, routing-compliant traffic flow.
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic