SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?
⚠ Common exam trap
SAP-C02 often tests whether candidates confuse signed URLs (which control end-user access to CloudFront) with OAC (which controls CloudFront's access to S3) — the requirement to block direct S3 access specifically demands OAC plus a restrictive bucket policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.
CloudFront Origin Access Control (OAC) is the current AWS-recommended mechanism to restrict S3 bucket access to a specific CloudFront distribution. By creating an OAC, associating it with the distribution's origin, and updating the S3 bucket policy to allow only that OAC's service principal, direct access to the S3 bucket is blocked while CloudFront can still fetch objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.
Why this is correct
Origin Access Control signs CloudFront requests to S3 and pairs with a bucket policy permitting only that distribution, blocking direct S3 URLs. This satisfies the requirement that content be reachable solely through CloudFront, replacing the older, less secure origin access identity approach.
- ✗
Set S3 Object Ownership to BucketOwnerPreferred.
Why it's wrong here
BucketOwnerPreferred governs ownership of objects uploaded by other accounts; it does not restrict access, so direct S3 requests still succeed. It is tempting because ownership settings matter when consolidating cross-account uploads, which is the correct scenario for that setting rather than enforcing CloudFront-only delivery.
- ✗
Configure the S3 bucket policy to allow public read access.
Why it's wrong here
A public-read bucket policy grants anonymous access to every object, directly enabling the bypass the company wants to prevent. It is tempting because public read is the quick way to serve website assets, and it is correct when content is genuinely public and CloudFront is merely an optional caching layer.
- ✗
Generate CloudFront key pairs and require signed URLs for all content.
Why it's wrong here
Signed URLs authenticate individual requests but do not stop someone fetching the object directly from S3, since the bucket remains independently reachable. They are tempting because they restrict who may use a distribution, which is correct when content must be time-limited or user-specific rather than CloudFront-exclusive.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?
easy- A.Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.
- ✓ B.Create an origin access identity (OAI) and grant it read access to the S3 bucket.
- C.Attach an IAM role to CloudFront distribution.
- D.Configure CloudFront signed URLs.
Why B: Create an origin access identity (OAI) and grant it read access to the S3 bucket. An OAI is a special CloudFront user that allows CloudFront to access private S3 bucket content securely. Option A is incorrect because CloudFront does not have static public IP ranges; it uses a large dynamic range. Option C is incorrect because IAM roles are not used directly for CloudFront to S3 access; OAI is the standard method. Option D is incorrect because signed URLs control end-user access, not origin access.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.