AWS Certified Solutions Architect CloudFront and Content Delivery 1 — Questions and Answers
Question 1: What is the primary purpose of Amazon CloudFront?
- To store objects with high durability across multiple AZs
- To distribute content globally with low latency via edge locations (Correct answer)
- To provide dedicated network connections from on-premises to AWS
- To replicate databases across AWS regions
Correct answer: To distribute content globally with low latency via edge locations
CloudFront is a content delivery network (CDN) that caches and serves content from edge locations close to end users, reducing latency.
Question 2: A company wants to run custom authentication logic at AWS edge locations before requests reach the origin. Which CloudFront feature enables this?
- CloudFront Functions
- Lambda@Edge (Correct answer)
- CloudFront Origin Shield
- CloudFront Field-Level Encryption
Correct answer: Lambda@Edge
Lambda@Edge allows you to run Node.js or Python Lambda functions at CloudFront edge locations to customize content delivery, including at the viewer-request stage for authentication.
Question 3: Which CloudFront feature restricts access to an S3 bucket so that only CloudFront can read objects, preventing direct S3 access?
- CloudFront Signed Cookies
- S3 Bucket Policy with IP whitelist
- Origin Access Control (OAC) (Correct answer)
- CloudFront Origin Shield
Correct answer: Origin Access Control (OAC)
Origin Access Control (OAC) is the recommended mechanism that grants CloudFront permission to access a private S3 bucket while blocking direct public access.
Question 4: A CloudFront distribution is configured with an S3 origin. A user requests an object that is not currently cached at the edge location. What happens next?
- CloudFront returns a 404 error to the user
- CloudFront fetches the object from the S3 origin, caches it, and returns it to the user (Correct answer)
- CloudFront redirects the user directly to the S3 bucket URL
- CloudFront waits for the next scheduled cache refresh before fetching the object
Correct answer: CloudFront fetches the object from the S3 origin, caches it, and returns it to the user
On a cache miss, CloudFront forwards the request to the configured origin (e.g., S3), retrieves the object, stores it in the edge cache, and delivers it to the user.
Question 5: Which CloudFront feature allows you to block or allow content delivery based on a viewer's country?
- CloudFront Signed URLs
- AWS WAF geographic match conditions
- CloudFront Geographic Restrictions (Geo-Blocking) (Correct answer)
- Route 53 Latency-Based Routing
Correct answer: CloudFront Geographic Restrictions (Geo-Blocking)
CloudFront Geographic Restrictions (also called geo-blocking) lets you whitelist or blacklist specific countries to control where your content is distributed.
Question 6: An architect needs to serve HTTPS content via CloudFront using a custom domain name. What must be provisioned?
- An ACM SSL certificate in the us-east-1 (N. Virginia) region (Correct answer)
- An ACM SSL certificate in the same region as the origin
- A self-signed certificate uploaded to IAM in any region
- An ACM certificate in the AWS GovCloud region
Correct answer: An ACM SSL certificate in the us-east-1 (N. Virginia) region
CloudFront requires SSL/TLS certificates from AWS Certificate Manager (ACM) to be provisioned specifically in the us-east-1 (N. Virginia) region for use with distributions.
Question 7: What is the purpose of setting a TTL (Time-To-Live) value in a CloudFront cache behavior?
- It determines how long CloudFront waits for an origin response before timing out
- It controls how long CloudFront caches an object at edge locations before checking the origin for updates (Correct answer)
- It sets the maximum duration a CloudFront distribution can remain active
- It defines the lifespan of a CloudFront signed URL
Correct answer: It controls how long CloudFront caches an object at edge locations before checking the origin for updates
TTL specifies the duration (in seconds) that CloudFront keeps a cached copy of an object at an edge location before it is considered stale and the origin is checked.
AWS Certified Solutions Architect CloudFront and Content Delivery 1
What is the primary purpose of Amazon CloudFront?