AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 12
A company uses Amazon S3 to store media content that is served through an Amazon CloudFront distribution. The media is consumed by global users but due to agreements in place in certain countries the content should not be viewable there.
What is the MOST cost effective solution to block access in specific countries?
-
A
Create a secondary origin access identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries.
-
B
Use Amazon Route 53 geolocation routing and route traffic from banned countries to an Amazon EC2 website that returns a 403 Forbidden HTTP response.
-
C
Enable the geo restriction feature in the CloudFront distribution and create a blacklist of banned countries.
-
D
Update a Network ACL with a deny rule based on the IP addresses of the banned countries.
Reveal correct answer
Correct answer: C
Explanation
You can use geo restriction, also known as geo blocking, to prevent users in specific geographic locations from accessing content that you're distributing through a CloudFront distribution.
When a user requests your content, CloudFront typically serves the requested content regardless of where the user is located. If you need to prevent users in specific countries from accessing your content, you can use the CloudFront geo restriction feature to do one of the following:
• Allow your users to access your content only if they're in one of the countries on a whitelist of approved countries.
• Prevent your users from accessing your content if they're in one of the countries on a blacklist of banned countries.
CORRECT: "Enable the geo restriction feature in the CloudFront distribution and create a blacklist of banned countries" is the correct answer.
INCORRECT: "Update a Network ACL with a deny rule based on the IP addresses of the banned countries" is incorrect. A Network ACL does not apply as the application does not use EC2 instances in subnets.
INCORRECT: "Create a secondary origin access identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries" is incorrect.
You cannot have multiple OAIs for a single bucket and it would not be efficient to use a bucket policy do deny access from specific countries (you’d need a massive list of IPs that would change over time; and cached content may still be served).
INCORRECT: "Use Amazon Route 53 geolocation routing and route traffic from banned countries to an Amazon EC2 website that returns a 403 Forbidden HTTP response" is incorrect. It doesn’t make much sense to run a website on EC2 just for this purpose and would not be cost-effective.
References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
