Amazon Exam SCS-C01 Topic 1 Question 64 Discussion

Actual exam question for Amazon's SCS-C01 exam

Question #: 64
Topic #: 1

A web application gives users the ability to log in verify their membership's validity and browse artifacts that are stored in an Amazon S3 bucket. When a user attempts to download an object, the application must verify the permission to access the object and allow the user to download the object from a custom domain name such as example com.

What is the MOST secure way for a security engineer to implement this functionality?

AConfigure read-only access to the object by using a bucket ACL. Remove the access after a set time has elapsed.

BImplement an IAM policy to give the user read access to the S3 bucket.

CCreate an S3 presigned URL Provide the S3 presigned URL to the user through the application.

DCreate an Amazon CloudFront signed URL. Provide the CloudFront signed URL to the user through the application.

Show Suggested Answer

Suggested Answer: D

For this scenario you would need to set up static website hosting because a custom domain name is listed as a requirement. 'Amazon S3 website endpoints do not support HTTPS or access points. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3.' This is not secure. https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-walkthrough.html CloudFront signed URLs allow much more fine-grained control as well as HTTPS access with custom domain names: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html

by Joanna at Jul 05, 2024, 04:23 AM

Limited Time Offer

25%

Off

Get Premium SCS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Adelle

5 months ago

Haha, I bet the security engineer is really gonna enjoy this one. Gotta love those AWS security features!

upvoted 0 times

Willetta

3 months ago

C: Definitely, it adds an extra layer of security to the process.

upvoted 0 times

...

Jacki

3 months ago

C: Definitely, it adds an extra layer of security to the process.

upvoted 0 times

...

Lavina

3 months ago

B: Yeah, that way the user can access the object through a secure URL provided by CloudFront.

upvoted 0 times

...

Izetta

3 months ago

B: Yeah, that way the user can access the object securely through the application.

upvoted 0 times

...

Lisbeth

3 months ago

A: I think the most secure way would be to create an Amazon CloudFront signed URL.

upvoted 0 times

...

Tanesha

4 months ago

A: I think the best way is to create an S3 presigned URL and provide it to the user.

upvoted 0 times

...

Sabine

5 months ago

I think configuring read-only access with a bucket ACL and removing access after a set time is the most secure option.

upvoted 0 times

...

Isaiah

5 months ago

I believe creating an S3 presigned URL is also secure as it provides temporary access to the object.

upvoted 0 times

...

Melita

5 months ago

I agree with Karon. Using CloudFront signed URL adds an extra layer of security.

upvoted 0 times

...

Moira

5 months ago

I agree with Rosamond. Presigned URLs are the best solution here. It allows you to control the access and expiration of the download link.

upvoted 0 times

Lorrie

4 months ago

Yeah, it's a good way to ensure only authorized users can download the object.

upvoted 0 times

...

Lucy

4 months ago

Using a presigned URL definitely adds an extra layer of security.

upvoted 0 times

...

Val

5 months ago

I agree, it's the most secure option for controlling access.

upvoted 0 times

...

Lakeesha

5 months ago

I think creating an S3 presigned URL is the way to go.

upvoted 0 times

...

Rosamond

5 months ago

Option C is the way to go! Presigned URLs are the most secure way to grant temporary access to S3 objects.

upvoted 0 times

Lynette

4 months ago

I agree, presigned URLs provide temporary secure access.

upvoted 0 times

...

Meghan

5 months ago

I think option C is the best choice.

upvoted 0 times

...

Karon

6 months ago

I think the most secure way is to create an Amazon CloudFront signed URL.

upvoted 0 times

...