Exam AWS Certified Security - Specialty topic 1 question 281 discussion

Answer: A C For Enable Geo-Restriction, choose Yes. For Restriction Type, choose Whitelist to allow access to certain countries, or choose Blacklist to block access from certain countries. https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-geo-restriction/

Restrict access to CF distro through OAI might not directly help with geo-restriction, until you pick option C alongside it. It enforces flow to be only through CF, where the geo-restriction in place. AC are correct.

A,C no doubts

Reference: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-geo-restriction/

A with Remove DefaultAllowAll SCP

Answer AC

AC right answer

AC is right answer

https://stackoverflow.com/questions/68771912/restrict-my-amazon-s3-bucket-access-to-specific-country Based on the above link finalizing C is the right option. Hence opting AC

A to make sure files cannot be accessed directly. C because: To add geographic restrictions to your CloudFront web distribution (console) Sign in to the AWS Management Console and open the CloudFront console at https://console.aws.amazon.com/cloudfront/v3/home. Choose the distribution that you want to update. Choose Geographic restrictions. Choose Edit. Select Allow list to create a list of allowed countries, or Block list to create a list of blocked countries. Add the desired countries to the list, then choose Save changes https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html

a and c , only allow access from the CF, and then apply geo-restrictions on CF

AC https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html

A&C C- restricts access from unlicensed countries A - Make sure y only use cloudfront to access images ( s3 direct url won't work )

AC is my answer.!

AC. the issue here is with people accessing website from countries without license and so we should limit access to Cloudfront only and use cloudfront geolocation to make sure only licensed countries can access website

If you restrict OAI, you will have chances to make the s3 objects access via public

Correct Answer is B & E https://aws.amazon.com/about-aws/whats-new/2013/12/18/amazon-cloudfront-adds-geo-restriction-feature/#:~:text=We%20are%20excited%20to%20announce,CloudFront%20to%20deliver%20your%20content.