AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 63

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is the origin in an Amazon CloudFront distribution. The company wants to implement a custom authentication system that will provide a token for its authenticated customers.
The web application must ensure that the GET/POST requests come from authenticated customers before it delivers the content. A network engineer must design a solution that gives the web application the ability to identify authorized customers.
What is the MOST operationally efficient solution that meets these requirements?

Answer options

• A. Use the ALB to inspect the authorized token inside the GET/POST request payload. Use an AWS Lambda function to insert a customized header to inform the web application of an authenticated customer request.
• B. Integrate AWS WAF with the ALB to inspect the authorized token inside the GET/POST request payload. Configure the ALB listener to insert a customized header to inform the web application of an authenticated customer request.
• C. Use an AWS Lambda@Edge function to inspect the authorized token inside the GET/POST request payload. Use the Lambda@Edge function also to insert a customized header to inform the web application of an authenticated customer request.
• D. Set up an EC2 instance that has a third-party packet inspection tool to inspect the authorized token inside the GET/POST request payload. Configure the tool to insert a customized header to inform the web application of an authenticated customer request.

Correct answer: C

Explanation

The correct answer is C because using AWS Lambda@Edge provides a serverless and scalable solution to inspect requests at the CloudFront edge locations, ensuring low latency for users. Options A and B require additional resources and complexity by relying on ALB or AWS WAF, which may not be as efficient as Lambda@Edge. Option D introduces unnecessary overhead and complexity by utilizing a separate EC2 instance and third-party tools.