SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CloudFront only supports HTTP origins, not HTTPS.

  Why it's wrong here

  CloudFront supports both HTTP and HTTPS origins, so the statement is false. You configure an Origin Protocol Policy to decide whether CloudFront connects to your origin via HTTP or HTTPS, and for custom origins HTTPS requires a valid TLS/SSL certificate on the origin. AWS also offers the 'Origin SSL Protocols' setting to control which TLS versions are used. In practice, most S3 origins are HTTPS-only, but HTTP is still supported for custom origins.

• ✗

  CloudFront can only use S3 buckets as origins.

  Why it's wrong here

  CloudFront can use S3 buckets, but it also fully supports custom origins such as EC2 instances, Elastic Load Balancers, AWS Lambda Function URLs, and even on-premises HTTP servers. A custom origin is any public-facing endpoint defined by a DNS name, and CloudFront's 'S3 origin' type is reserved for S3 REST API endpoints. This flexibility is why ALBs and static S3 website endpoints are common alternatives to native S3 origins.

• ✓

  CloudFront can use an Application Load Balancer as an origin.

  Why this is correct

  An Application Load Balancer is a supported custom origin for CloudFront, which is why the statement is correct. You point the origin domain name to the ALB's DNS name (for example, my-alb-1234567890.us-east-1.elb.amazonaws.com) and configure the protocol (HTTP or HTTPS) that CloudFront should use when forwarding requests. Because the ALB is a public endpoint, you must ensure its security group allows inbound traffic from CloudFront's IP ranges, and it can be used to serve dynamic or mixed content behind CloudFront.

• ✗

  CloudFront origins must be in the same region as the distribution.

  Why it's wrong here

  CloudFront does not require its origin to reside in the same region as the distribution; origins can be in any AWS Region or even on-premises. When a CloudFront edge location receives a request, it forwards the request to the origin's public DNS name over the internet (or via private networking like Direct Connect for custom origins). The main consideration is latency, but geographic proximity between edge and origin is not a hard requirement.

• ✓

  CloudFront can use an S3 bucket configured as a static website as an origin.

  Why this is correct

  A bucket configured for S3 static website hosting is a valid custom origin for CloudFront, and this statement is correct. The website endpoint (e.g., bucket-name.s3-website-region.amazonaws.com) is classified as a custom origin because it only supports HTTP, so you must set the origin protocol policy to HTTP Only. This differs from the S3 REST endpoint, which is a native S3 origin and supports HTTPS; you can also use OAC to restrict access to the REST endpoint.

Go deeper

Related to this question