Topic 1 Question 194
A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application.
Which solution will meet these requirements in the MOST operationally efficient way?
Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.
Add an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.
Configure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.
Associate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.
ユーザの投票
コメント(9)
It is asking a solution at network layer rather than application layer. Therefore it is A in my opinion.
A managed prefix list is a set of one or more CIDR blocks. You can use prefix lists to make it easier to configure and maintain your security groups and route tables.
👍 6veyisceylan2024/06/21- 正解だと思う選択肢: A
Option A is the most operationally efficient solution as it leverages AWS managed prefix lists, ensuring up-to-date and secure traffic management to the ALB from CloudFront. Security groups provide a straightforward way to enforce network layer restrictions without additional administrative overhead or application changes. This aligns well with the requirement to implement a solution strictly at the network layer.
👍 3Akshay04032024/07/23 - 正解だと思う選択肢: A
Question explicitly ask for changes at network layer.
👍 3[Removed]2024/08/17
シャッフルモード