AWS Certified SysOps Administrator – Associate — Question 84

A company is storing media content in an Amazon S3 bucket and uses Amazon CloudFront to distribute the content to its users. Due to licensing terms, the company is not authorized to distribute the content in some countries. A SysOps administrator must restrict access to certain countries.

What is the MOST operationally efficient solution that meets these requirements?

Answer options

• A. Configure the S3 bucket policy to deny the GetObject operation based on the S3:LocationConstraint condition.
• B. Create a secondary origin access identity (OAI). Configure the S3 bucket policy to prevent access from unauthorized countries.
• C. Enable the geo restriction feature in the CloudFront distribution to prevent access from unauthorized countries.
• D. Update the application to generate signed CloudFront URLs only for IP addresses in authorized counties.

Correct answer: C

Explanation

The most operationally efficient solution is to enable the geo restriction feature in the CloudFront distribution, as it directly prevents access based on geographic locations without altering the S3 bucket policy or application logic. The other options involve more complex configurations or modifications that may not be as efficient for simply restricting access based on location.