You have an S3 bucket that stores customer-specific private files. You want to serve these files through CloudFront, where clients must use signed cookies (or signed URLs) to access the content. In addition, you need to block common web exploits and rate-limit suspicious traffic at the edge. Which design best meets these requirements?

Enable public read access on the S3 bucket and rely on WAF alone for authorization because WAF can validate signatures.

WAF is not meant to replace authorization signatures for content protection, and public S3 access undermines security. Even if WAF blocks some traffic, public access allows requests that bypass your intended controls if misconfigured. Signed cookies/URLs are the appropriate edge authorization mechanism.

Configure CloudFront with signed URLs but do not change the S3 bucket access settings; leaving public access enabled is acceptable since CloudFront can filter traffic.

If the S3 bucket remains public, clients can bypass CloudFront entirely by accessing the S3 object URLs directly. Signed URLs protect only requests going through CloudFront behaviors, not direct S3 origin access. The origin must be restricted so content cannot be retrieved outside CloudFront.

Use WAF at CloudFront but omit signed cookies/URLs because rate limiting and exploit blocking already provide access control for private files.

WAF protections can reduce threats but do not implement business authorization for specific customers. Rate limiting and exploit blocking do not prevent an authorized user from sharing links or retrieving content without required authentication. Signed cookies/URLs are specifically for controlling content access.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Keep the S3 bucket private, configure CloudFront with Origin Access Control so only CloudFront can access the origin, require signed cookies/URLs for viewers, and associate an AWS WAF web ACL with CloudFront for blocking and rate limiting. — The secure pattern for private content delivered by CloudFront is: keep the S3 origin private so objects cannot be fetched directly, use CloudFront (via Origin Access Control) as the only authorized origin caller, and require signed cookies/URLs to authorize each viewer request. To address common exploits and suspicious traffic patterns, associate an AWS WAF web ACL with the CloudFront distribution. This combination enforces both content authorization (signed access) and edge threat mitigation (WAF rules). Option B and C fail because leaving S3 public allows bypassing CloudFront controls and violates private content requirements. Option D uses WAF for threat mitigation only; it does not provide customer-specific authorization. WAF can block or rate limit malicious requests, but without signed cookies/URLs it cannot ensure only intended principals can retrieve the protected objects.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.