SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.

  Why it's wrong here

  Making the ALB internal and using a CloudFront VPC origin is technically plausible only when the ALB is deployed as an internet-facing endpoint; CloudFront's edge infrastructure cannot route to a private, internal ALB because a VPC origin still requires a public DNS target with a public IP. An internal ALB has only private IP addresses in the VPC, which CloudFront cannot reach, so this configuration breaks origin connectivity entirely. Even if you used an internet-facing ALB inside a VPC, the safety comes from the ALB's security group, not from the VPC itself, so this option does not meet the requirement.

• ✗

  Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.

  Why it's wrong here

  There is no standard 'X-CloudFront-Origin' header added by CloudFront; you can only configure CloudFront to add arbitrary custom headers per origin, which any direct client can trivially spoof by sending the same header value. Relying on a header as an access-control mechanism provides no cryptographic proof the request originated from CloudFront, so an attacker can bypass the ALB security by manually including that header in their HTTP request. Correct origin protection combines security group restrictions with a shared secret header or AWS WAF, never a header alone.

• ✗

  Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.

  Why it's wrong here

  IAM roles govern how AWS principals authenticate to AWS APIs and services; an Application Load Balancer does not assume an IAM role to accept or reject inbound network connections. The ALB operates as a Layer 7 service that processes traffic based on listener rules, target groups, and security group policies, not on IAM principals. CloudFront also does not perform IAM-based authentication when forwarding requests to an ALB; it simply resolves the origin DNS and connects over the network, so this option misunderstands the boundary between AWS authorization and network traffic control.

• ✓

  Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.

  Why this is correct

  This is the correct and recommended approach: AWS publishes the complete set of CloudFront IP addresses used to fetch content from origins in the ip-ranges.json file, with a specific service indicator (CLOUDFRONT_ORIGIN_FACING). By adding a security group rule that allows inbound TCP 80/443 only from those CIDR blocks, the ALB will refuse connections from any other public IP, including direct internet clients that bypass CloudFront. You can implement this effectively using a managed prefix list that AWS keeps updated, or by periodically refreshing your security group rules from the published ranges.

Go deeper

Related to this question