SOA-C02 Networking and Content Delivery Practice Question
A company uses Amazon CloudFront to deliver content from an Application Load Balancer (ALB) origin. The SysOps administrator needs to restrict access to the content so that only users from a specific geographic location can view it. Which CloudFront feature should be used?
⚠ Common exam trap
Watch out — candidates often confuse AWS WAF's geo-match rules with CloudFront's built-in geographic restrictions, but the question asks for a CloudFront feature, and the native geo-blocking feature is the correct, simpler answer without requiring an additional service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Geographic restrictions (geo-blocking) in CloudFront
CloudFront's geographic restrictions (geo-blocking) feature allows you to restrict access to content based on the geographic location of the viewer's IP address. This is the simplest and most direct method to ensure only users from a specific country or region can access the content delivered through CloudFront, without requiring any changes to the origin or additional authentication mechanisms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Geographic restrictions (geo-blocking) in CloudFront
Why this is correct
CloudFront's native geo-restriction feature allows you to configure an allowlist or blocklist of two-letter ISO country codes directly in the distribution's settings. When a viewer in a denied country requests content, CloudFront's edge locations reject the request with an HTTP error before it ever reaches the origin. This works at the edge, requires no code or additional AWS services, and precisely matches the requirement of restricting access by geographic location. Because this feature is built into CloudFront itself, it is the correct choice among the options.
- ✗
Origin Access Identity (OAI)
Why it's wrong here
An Origin Access Identity (OAI) is an IAM principal that CloudFront uses to fetch objects from a private Amazon S3 bucket, ensuring only CloudFront can read the underlying content. It is a mechanism for securing the origin, not for controlling who can access CloudFront's distribution. The OAI authenticates CloudFront to S3, but it says nothing about the viewer's country or IP address, so it cannot impose geographic restrictions. In short, OAI protects the source from direct external access but does not filter requests by location.
- ✗
Signed URLs
Why it's wrong here
Signed URLs allow you to grant temporary access to specific CloudFront objects by appending a cryptographic signature, with optional expiration time and IP address restrictions. This is a per-viewer authorization mechanism, typically used for premium content or to restrict access to trusted users. While a signed URL can restrict to a particular IP range, that range is arbitrary and not automatically mapped to a country, so it does not provide the simpler country-level geo-blocking required here. Furthermore, creating signed URLs requires a signing key and application logic, making it far more complex than CloudFront's native geographic restriction.
- ✗
AWS WAF web ACL associated with the CloudFront distribution
Why it's wrong here
AWS WAF web ACLs can perform geo-blocking using geo-match rules, making this option tempting as it *can* achieve the desired outcome of restricting access by geographic location. However, the question asks for a *CloudFront feature*. CloudFront has a dedicated, native Geo-restriction feature built directly into the distribution configuration for this specific purpose. WAF is primarily designed for protecting web applications from common exploits and implementing more granular, complex access control rules based on various request attributes, rather than simple country-level geo-restriction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.