SAA-C03 Design Secure Architectures Practice Question
A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?
⚠ Common exam trap
Many candidates confuse CloudFront signed URLs with S3 pre-signed URLs, but S3 pre-signed URLs work at the S3 bucket level and do not leverage CloudFront's edge caching or origin access control, whereas CloudFront signed URLs are the correct feature for controlling access at the CDN edge with expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Signed URLs or signed cookies with an expiration time of 1 hour
Signed URLs or signed cookies allow CloudFront to grant temporary access to private content by embedding authentication information (policy, signature, key pair ID) directly in the request. By setting an expiration time of 1 hour in the policy statement, access automatically becomes invalid after that period, meeting both the authentication and expiry requirements without exposing the S3 bucket publicly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Signed URLs or signed cookies with an expiration time of 1 hour
Why this is correct
Signed URLs or signed cookies are the native CloudFront authorization mechanism for restricting access to private content. Each signature is generated with a CloudFront key pair and embeds an expiration timestamp via a canned or custom policy; when a request arrives, edge locations cryptographically verify both the signature and the expiration field before forwarding the request to the S3 origin through an origin access control (OAC). After the 1-hour window passes, CloudFront rejects the request with an HTTP 403 error at the edge, so the S3 bucket never needs to perform time-based authorization logic. Because the authentication is cryptographic and enforced independently at every CloudFront edge location, it provides exactly the desired time-limited, per-resource access control without exposing the bucket directly.
- ✗
A WAF rule that blocks requests without valid JWTs, without using signed URLs
Why it's wrong here
WAF can inspect and block requests, but it is not the primary built-in CloudFront mechanism for time-limited, resource-scoped authorization. Implementing expiring per-user access with JWT validation via WAF is possible in some architectures, but it is not the most direct, native CloudFront feature described for this requirement.
When this WOULD be correct
A company needs to allow or block access to a CloudFront distribution based on geographic location, and they want to use a managed rule set to filter requests by country. In that case, a WAF geo-match rule would be correct.
- ✗
Turning on S3 bucket public access block, without any CloudFront viewer authentication
Why it's wrong here
Blocking public access ensures the objects can’t be fetched directly from S3, but it does not automatically ensure only authenticated users can fetch via CloudFront. If the CloudFront distribution allows access (and the origin access/OAC configuration permits it), requests can still reach CloudFront without user authentication and without a 1-hour expiry control.
When this WOULD be correct
A company wants to ensure that all objects in an S3 bucket are not publicly accessible and can only be accessed through CloudFront using an Origin Access Control (OAC). The requirement is to block direct S3 access, not to authenticate individual viewers.
- ✗
Enabling CloudFront geo restriction to allow only one country
Why it's wrong here
CloudFront geo restriction simply evaluates the requester's geographic IP location and either allows or blocks requests based on a country allowlist or blocklist. It cannot distinguish between authenticated and unauthenticated users, nor can it enforce a per-user or per-session expiration window, so it does not limit access to a specific 1-hour period. Geo restriction is designed for content licensing or regional legal constraints, not for temporary secure access to private images; even if the bucket is private, any user in an allowed country could still access the content indefinitely through the distribution unless another authorization mechanism is also configured. Therefore, geo restriction alone fails the requirement for expiring, user-specific authorization.
When this WOULD be correct
A company wants to restrict access to content based on the viewer's country, such as complying with licensing agreements that only allow distribution in certain regions. In that case, enabling CloudFront geo restriction would be the correct feature.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Signed URLs or signed cookies with an expiration time of 1 hourCorrect answer▾
Why this is correct
Signed URLs or signed cookies are the native CloudFront authorization mechanism for restricting access to private content. Each signature is generated with a CloudFront key pair and embeds an expiration timestamp via a canned or custom policy; when a request arrives, edge locations cryptographically verify both the signature and the expiration field before forwarding the request to the S3 origin through an origin access control (OAC). After the 1-hour window passes, CloudFront rejects the request with an HTTP 403 error at the edge, so the S3 bucket never needs to perform time-based authorization logic. Because the authentication is cryptographic and enforced independently at every CloudFront edge location, it provides exactly the desired time-limited, per-resource access control without exposing the bucket directly.
✗A WAF rule that blocks requests without valid JWTs, without using signed URLsWrong answer — click to see why▾
Why this is wrong here
WAF rules can block requests based on JWTs, but they do not provide time-limited access to specific content. CloudFront signed URLs or cookies are required to enforce expiration and per-user access to private S3 content.
★ When this WOULD be the correct answer
A company needs to allow or block access to a CloudFront distribution based on geographic location, and they want to use a managed rule set to filter requests by country. In that case, a WAF geo-match rule would be correct.
Why candidates choose this
Candidates may think that WAF with JWT validation can replace signed URLs for authentication, but WAF does not generate or manage signed URLs or cookies with expiration for individual objects.
✗Turning on S3 bucket public access block, without any CloudFront viewer authenticationWrong answer — click to see why▾
Why this is wrong here
Turning on S3 bucket public access block prevents all public access, but does not provide any authentication mechanism for CloudFront. Without signed URLs or cookies, any viewer with the CloudFront URL can access the content, and there is no expiration control.
★ When this WOULD be the correct answer
A company wants to ensure that all objects in an S3 bucket are not publicly accessible and can only be accessed through CloudFront using an Origin Access Control (OAC). The requirement is to block direct S3 access, not to authenticate individual viewers.
Why candidates choose this
Candidates may think that blocking public access to the S3 bucket is sufficient to secure content, but they overlook that CloudFront itself needs to authenticate viewers to restrict access to authorized users only.
✗Enabling CloudFront geo restriction to allow only one countryWrong answer — click to see why▾
Why this is wrong here
Geo restriction only limits access based on geographic location, not user authentication, and does not provide time-limited access. It cannot ensure that only authenticated users can access images or that access expires after 1 hour.
★ When this WOULD be the correct answer
A company wants to restrict access to content based on the viewer's country, such as complying with licensing agreements that only allow distribution in certain regions. In that case, enabling CloudFront geo restriction would be the correct feature.
Why candidates choose this
Candidates may mistakenly think geo restriction can control user access and expiration, confusing geographic limitations with authentication and time-based access controls.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 935 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.