Amazon DOP-C02 Exam - Topic 4 Question 70 Discussion

Question

A company deployed an Amazon CloudFront distribution that accepts requests and routes to an Amazon API Gateway HTTP API. During a recent security audit, the company discovered that requests from the internet could reach the HTTP API without using the CloudFront distribution.

A DevOps engineer must ensure that connections to the HTTP API use the CloudFront distribution.

Which solution will meet these requirements?

Alexis · Accepted Answer

D) Implement a custom header in the CloudFront distribution. Implement an AWS Lambda authorizer associated with the HTTP API that verifies the custom header.

Alexis · Answer

A) Enable VPC Flow Logs to identify requests that reach the HTTP API.

Alexis · Answer

B) Deploy AWS WAF in front of the CloudFront distribution.

Alexis · Answer

C) Implement an identity-based policy on the CloudFront distribution that requires authentication to make requests to the HTTP API.