The correct answer is to configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access. This works because OAC uses a CloudFront-owned service principal to sign all requests to the S3 bucket, and the bucket policy must explicitly grant the `s3:GetObject` action to that principal, effectively blocking any direct S3 access from other sources. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this topic tests your understanding of modern security best practices over the legacy Origin Access Identity (OAI) method; a common trap is choosing OAI, which is now deprecated for new distributions. Remember that OAC is the recommended solution when you need to restrict S3 bucket access to CloudFront only, as it provides finer-grained control and supports features like cross-region access. A simple memory tip: OAC stands for "Only Access from CloudFront" — if you see OAC on the exam, it’s the secure, up-to-date choice.
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Amazon CloudFront to deliver static content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which solution should be used?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access.
Option D is correct because Origin Access Control (OAC) is the recommended method to restrict S3 bucket access exclusively to CloudFront. OAC uses a CloudFront-owned service principal to sign requests, and the S3 bucket policy must explicitly grant the `s3:GetObject` action to that principal, ensuring no direct S3 access from other sources.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use pre-signed URLs for all objects.
Why it's wrong here
Pre-signed URLs are for temporary user access.
✗
Use an S3 bucket policy that allows access from any AWS service.
Why it's wrong here
Overly permissive, not specific to CloudFront.
✗
Generate CloudFront key pairs and configure signed URLs.
Why it's wrong here
Signed URLs are for user access, not origin restriction.
✓
Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access.
Why this is correct
OAC is the current best practice.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing origin security (restricting S3 bucket access to CloudFront) with viewer security (restricting who can view content via signed URLs or cookies), leading candidates to incorrectly choose signed URLs or key pairs.
Detailed technical explanation
How to think about this question
Origin Access Control (OAC) replaces the older Origin Access Identity (OAI) and uses a CloudFront service principal (e.g., `cloudfront.amazonaws.com`) with a condition in the S3 bucket policy that checks the `aws:SourceArn` or `aws:SourceAccount` to further restrict access to a specific distribution. Under the hood, CloudFront signs requests to S3 using its own credentials, and S3 validates the signature against the policy, preventing direct S3 URL access or access from other services.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Networking and Content Delivery — This question tests Networking and Content Delivery — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access. — Option D is correct because Origin Access Control (OAC) is the recommended method to restrict S3 bucket access exclusively to CloudFront. OAC uses a CloudFront-owned service principal to sign requests, and the S3 bucket policy must explicitly grant the `s3:GetObject` action to that principal, ensuring no direct S3 access from other sources.
What should I do if I get this SOA-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Amazon CloudFront distribution that delivers static content from an Amazon S3 bucket. The SysOps administrator needs to ensure that the content can only be accessed through CloudFront and not directly from the S3 bucket URL. The solution should use AWS managed services with minimal configuration. Which solution should the administrator implement?
medium
✓ A.Configure the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI).
B.Make the S3 bucket private and use pre-signed URLs for CloudFront.
C.Use AWS WAF on CloudFront to block direct access to S3 by checking the Referer header.
D.Create a VPC endpoint for S3 and restrict access to the bucket from the CloudFront IP addresses.
Why A: Option A is correct because configuring the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI) ensures that only CloudFront can retrieve objects from the S3 bucket. The OAI is a special CloudFront user that authenticates requests to S3, and the bucket policy explicitly grants GetObject access only to that principal, blocking any direct S3 URL access. This uses AWS managed services (CloudFront and S3) with minimal configuration—no custom code or additional infrastructure.
Variation 2. A company is using Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. How should this be configured?
hard
✓ A.Configure Origin Access Control (OAC) with the S3 bucket policy.
B.Use CloudFront signed URLs or cookies.
C.Attach an IAM role to CloudFront that grants S3 read access.
D.Create a bucket policy that allows access only from the CloudFront distribution's IP addresses.
Why A: Option D is correct because Origin Access Control (OAC) ensures only CloudFront can access the bucket. Option A is wrong because bucket policies can be used but OAC is the modern recommended approach. Option B is wrong because CloudFront key pairs are for signed URLs/cookies, not origin access. Option C is wrong because IAM roles are used for EC2, not for CloudFront access to S3.
Variation 3. A company uses Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access to content based on geographic location. Some countries should be blocked entirely. The administrator configured a CloudFront geographic restriction (whitelist/blacklist) and updated the S3 bucket policy to allow only CloudFront access via Origin Access Identity (OAI). However, users from blocked countries are still able to access some content. What is the most likely cause?
medium
✓ A.CloudFront geographic restrictions only block access to the CloudFront distribution, but the S3 bucket is still publicly accessible
B.The S3 bucket policy does not include a condition to restrict access to only CloudFront
C.The geographic restriction is configured as a whitelist instead of a blacklist
D.CloudFront geographic restrictions are applied at the edge location, but some edge locations may not have the restriction updated
Why A: Option C is correct because CloudFront geographic restrictions only apply to edge locations; if the content is cached at an edge location, the restriction is enforced at that edge. However, if the origin is directly accessible (bypassing CloudFront), the restriction is not applied. But the question says users from blocked countries can access some content, suggesting that the OAI might not be configured correctly or the bucket policy allows direct access. Option A is wrong because the S3 bucket policy is correct. Option B is wrong because geographic restriction is global. Option D is wrong because the bucket policy is set correctly.
Variation 4. A company uses Amazon CloudFront to serve static content from an S3 bucket. The S3 bucket is configured as an origin with RestrictBucketAccess set to Yes, and the origin access identity (OAI) is configured. Users can access the content via CloudFront, but direct S3 URLs return Access Denied. However, some users report that they can still access the content directly via S3 URLs. What is the most likely reason?
hard
A.The OAI is not properly associated with the CloudFront distribution.
✓ B.The S3 bucket policy allows public read access in addition to the OAI.
C.The CloudFront distribution is using a custom origin instead of S3.
D.CloudFront is using pre-signed URLs that are being shared.
Why B: Option B is correct because if the bucket policy allows public read access, it overrides the OAI restriction. The OAI only restricts access if the bucket policy explicitly denies all principals except the OAI. Option A is wrong because the OAI is properly set up. Option C is wrong because CloudFront does not use pre-signed URLs for OAI. Option D is wrong because if the OAI is not in the bucket policy, the default is public access if the bucket is public.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.