A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?

A WAF rule that blocks requests without valid JWTs, without using signed URLs

WAF can inspect and block requests, but it is not the primary built-in CloudFront mechanism for time-limited, resource-scoped authorization. Implementing expiring per-user access with JWT validation via WAF is possible in some architectures, but it is not the most direct, native CloudFront feature described for this requirement.

Turning on S3 bucket public access block, without any CloudFront viewer authentication

Blocking public access ensures the objects can’t be fetched directly from S3, but it does not automatically ensure only authenticated users can fetch via CloudFront. If the CloudFront distribution allows access (and the origin access/OAC configuration permits it), requests can still reach CloudFront without user authentication and without a 1-hour expiry control.

Enabling CloudFront geo restriction to allow only one country

Geo restriction limits access by geographic location, not by user authentication and not by time-limited authorization. It does not provide expiring per-user/per-session access.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Signed URLs or signed cookies with an expiration time of 1 hour — Signed URLs or signed cookies are the correct CloudFront pattern for private content that requires authenticated-only access with a short expiration. By generating signatures with a 1-hour expiry, you ensure CloudFront validates the signature at the edge and only serves the requested objects to users who have received valid signed credentials. WAF may supplement security, but it does not replace CloudFront’s native signed authorization model for time-limited access to specific resources. Why others are wrong: Option B focuses on WAF/JWT blocking, which is not the most appropriate native feature for time-limited, resource-scoped access via CloudFront. Option C only affects direct S3 access; it does not enforce authenticated user access or a 1-hour expiry for requests through CloudFront. Option D enforces location-based restrictions rather than authentication-based, expiring access.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.