SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an origin access identity (OAI) and grant it read access to the S3 bucket.
Create an origin access identity (OAI) and grant it read access to the S3 bucket. An OAI is a special CloudFront user that allows CloudFront to access private S3 bucket content securely. Option A is incorrect because CloudFront does not have static public IP ranges; it uses a large dynamic range. Option C is incorrect because IAM roles are not used directly for CloudFront to S3 access; OAI is the standard method. Option D is incorrect because signed URLs control end-user access, not origin access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.
Why it's wrong here
CloudFront IPs change; OAI is the recommended method.
- ✓
Create an origin access identity (OAI) and grant it read access to the S3 bucket.
Why this is correct
OAI allows CloudFront to authenticate to S3.
- ✗
Attach an IAM role to CloudFront distribution.
Why it's wrong here
CloudFront does not support IAM roles for origin access.
- ✗
Configure CloudFront signed URLs.
Why it's wrong here
Signed URLs control user access, not origin access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?
easy- ✓ A.Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.
- B.Set S3 Object Ownership to BucketOwnerPreferred.
- C.Configure the S3 bucket policy to allow public read access.
- D.Generate CloudFront key pairs and require signed URLs for all content.
Why A: Using CloudFront Origin Access Control (OAC) restricts access to the S3 bucket so that only the CloudFront distribution can access objects. The bucket policy must be updated to grant CloudFront access. Option B is incorrect because S3 Object Ownership does not restrict access. Option C is incorrect because allowing public read access would enable direct S3 access. Option D is incorrect because CloudFront key pairs and signed URLs control access through CloudFront but do not prevent direct S3 bucket access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.