SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB to forward the custom header to the target group and validate it on the application.
Options B and C are correct. AWS WAF can inspect the custom header and block requests without it (Option C), and the ALB can forward the custom header to the target group where the application can validate it (Option B). Option A is incorrect because using CloudFront with signed URLs would add an extra layer but does not directly validate the custom header. Option D is incorrect because Amazon Cognito is used for authentication and user management, not for custom header validation. Option E is incorrect because security groups operate at the network layer and cannot inspect application headers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place an Amazon CloudFront distribution in front of the ALB and use signed URLs.
Why it's wrong here
Signed URLs are for CloudFront content, not for custom header validation.
- ✓
Configure the ALB to forward the custom header to the target group and validate it on the application.
Why this is correct
The application can validate the header if forwarded by ALB.
- ✓
Use AWS WAF to create a rule that inspects the custom header and blocks requests without it.
Why this is correct
WAF can inspect HTTP headers and block requests.
- ✗
Use Amazon Cognito to authenticate users and pass the header.
Why it's wrong here
Cognito provides user authentication but does not inspect custom headers.
- ✗
Configure the ALB's security group to allow traffic only from known IP addresses.
Why it's wrong here
Security groups filter by IP, not headers.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.