SOA-C02 Networking and Content Delivery Practice Question
A company uses Amazon CloudFront to distribute content globally. They need to restrict access to premium content to only authenticated users. Which THREE methods can be used to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lambda@Edge to validate JWT tokens
Lambda@Edge (C) is correct because it runs custom Node.js/Python code at CloudFront edge locations, allowing the function to inspect incoming requests and validate JWT tokens (e.g., checking signature, issuer, and expiry) before serving premium content. CloudFront signed cookies (D) are correct because they grant access to multiple restricted files (such as an entire premium video library or HLS segments) using a single Set-Cookie header with a signed policy, ideal when you don't want to change URLs per object. CloudFront signed URLs (E) are correct because they provide time-limited, cryptographically signed access to individual objects, commonly used for one-off downloads or streaming a single premium file. AWS WAF IP set rules (A) only filter by source IP address and do not authenticate users, so they cannot verify identity. AWS Shield Advanced (B) is a DDoS protection service and provides no user authentication or content access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF IP set rules to allow only known IPs
Why it's wrong here
IP set rules filter by source address, not by user identity, so anyone on an allowed network reaches the premium content. WAF IP sets suit blocking or permitting known network ranges, such as corporate egress addresses, rather than authenticating individual subscribers.
- ✗
AWS Shield Advanced to protect against DDoS
Why it's wrong here
Shield Advanced mitigates volumetric and layer 7 DDoS attacks; it performs no user authentication and grants access regardless of identity. It is the right control when protecting an application from attack traffic, not when gating content behind verified user credentials.
- ✓
Lambda@Edge to validate JWT tokens
Why this is correct
Lambda@Edge runs a function at CloudFront edge locations, letting you inspect the Authorization header and validate JWT tokens before the request reaches the origin, so unauthenticated viewers are rejected at the edge rather than at the origin.
- ✓
CloudFront signed cookies
Why this is correct
Signed cookies carry a CloudFront policy granting access to multiple restricted objects, so a viewer authenticates once and then requests many premium files without per-object signing, which suits restricting access to authenticated users across a content set.
- ✓
CloudFront signed URLs
Why this is correct
Signed URLs embed a CloudFront policy and signature granting time-limited access to one specific object, so only viewers holding a valid signed URL can retrieve that premium file, satisfying the requirement to restrict access to authenticated users.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.