AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 184

A company is using an Amazon CloudFront distribution that is configured with an Application Load Balancer (ALB) as an origin. A network engineer needs to implement a solution that requires all inbound traffic to the ALB to come from CloudFront. The network engineer must implement the solution at the network layer rather than in the application.

Which solution will meet these requirements in the MOST operationally efficient way?

Answer options

• A. Add an inbound rule to the ALB's security group to allow the AWS managed prefix list for CloudFront.
• B. Add an inbound rule to the network ACLs that are associated with the ALB's subnets. Use the AWS managed prefix list for CloudFront as the source in the rule.
• C. Configure CloudFront to add a custom HTTP header to the requests that CloudFront sends to the ALB.
• D. Associate an AWS WAF web ACL with the ALB. Configure the AWS WAF rules to allow traffic from the CloudFront IP set. Automatically update the CloudFront IP set by using an AWS Lambda function.

Correct answer: A

Explanation

Option A is correct because adding an inbound rule to the ALB's security group specifically allows only CloudFront traffic, efficiently enforcing the requirement at the network layer. Option B, while valid, involves additional configuration complexity with network ACLs, which may not be as efficient. Options C and D focus on application-level solutions or added layers of complexity instead of directly addressing the network layer requirement.