Examkin

Question

Difficulty: MediumAmazon CloudFront Caching, Origins, and Security

A company hosts a web application behind an Application Load Balancer (ALB) that serves as the custom origin for an Amazon CloudFront distribution. A SysOps administrator must secure the architecture to ensure that the ALB only processes traffic originating directly from CloudFront. Additionally, during promotional events, the administrator must protect the origin backend from being overwhelmed by duplicate requests originating from different regional cache locations. Which combination of configurations will meet these requirements? (Select TWO.)

  1. Configure CloudFront to add a custom HTTP header to origin requests, and configure the ALB listener rules to forward requests to the target group only if this header is present with the correct secret value.Answer
  2. Enable CloudFront Origin Shield in the distribution's origin settings, selecting the optimal AWS Region close to the origin backend.Answer
  3. C
    Configure an Amazon Route 53 CNAME record at the zone apex pointing to the CloudFront distribution domain name to restrict ALB origin traffic.
  4. D
    Configure the ALB's subnet route tables to direct all outbound responses through an Internet Gateway using a static ephemeral port range target.
  5. E
    Configure the ALB target group health checks to point to the CloudFront distribution domain name on port 443.

Answer

The correct configurations are to inject a custom HTTP header from CloudFront and verify it in the Application Load Balancer listener rules, and to enable CloudFront Origin Shield in the distribution's origin settings.
To secure the custom origin, configuring CloudFront to add a custom HTTP header with a secret value and configuring the Application Load Balancer (ALB) listener rules to only forward requests containing that custom header ensures that direct access to the ALB is blocked. To protect the origin from being overwhelmed by duplicate requests, enabling CloudFront Origin Shield creates a centralized caching layer that reduces origin requests during traffic spikes.

Step-by-Step Solution

1
Configure a custom header in the CloudFront distribution settings for the custom origin.
CloudFront automatically appends this custom header to every request it forwards to the Application Load Balancer.
This establishes a shared secret that can be used by the backend to identify valid CloudFront requests.
2
Modify the Application Load Balancer listener rules to forward requests to the target group only when the HTTP header matches the custom header and secret value.
Requests without the header or with incorrect values are rejected at the ALB level.
This prevents direct HTTP/HTTPS access to the ALB, ensuring only CloudFront-forwarded traffic is accepted.
3
Enable Origin Shield within the CloudFront origin configuration and select a regional edge cache close to the origin.
An extra caching layer is created between the regional edge caches and the custom origin.
This consolidates cache misses from multiple regional edge caches into a single request to the origin, preventing origin overload.

Key Concept

Securing custom origins with CloudFront custom headers and optimizing cache hit ratios with Origin Shield.
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic