Amazon Exam SCS-C01 Topic 1 Question 64 Discussion

Actual exam question for Amazon's SCS-C01 exam

Question #: 64
Topic #: 1

A web application gives users the ability to log in verify their membership's validity and browse artifacts that are stored in an Amazon S3 bucket. When a user attempts to download an object, the application must verify the permission to access the object and allow the user to download the object from a custom domain name such as example com.

What is the MOST secure way for a security engineer to implement this functionality?

AConfigure read-only access to the object by using a bucket ACL. Remove the access after a set time has elapsed.

BImplement an IAM policy to give the user read access to the S3 bucket.

CCreate an S3 presigned URL Provide the S3 presigned URL to the user through the application.

DCreate an Amazon CloudFront signed URL. Provide the CloudFront signed URL to the user through the application.

Show Suggested Answer

Suggested Answer: D

For this scenario you would need to set up static website hosting because a custom domain name is listed as a requirement. 'Amazon S3 website endpoints do not support HTTPS or access points. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3.' This is not secure. https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-walkthrough.html CloudFront signed URLs allow much more fine-grained control as well as HTTPS access with custom domain names: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html

by Joanna at Jul 05, 2024, 04:23 AM

Limited Time Offer

25%

Off

Get Premium SCS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

2 months ago

I agree with Rosamond. Presigned URLs are the best solution here. It allows you to control the access and expiration of the download link.

upvoted 0 times

Lorrie

23 days ago

Yeah, it's a good way to ensure only authorized users can download the object.

upvoted 0 times

...

Lucy

28 days ago

Using a presigned URL definitely adds an extra layer of security.

upvoted 0 times

...

Val

1 months ago

I agree, it's the most secure option for controlling access.

upvoted 0 times

...

Lakeesha

1 months ago

I think creating an S3 presigned URL is the way to go.

upvoted 0 times

...

2 months ago

I think the most secure way is to create an Amazon CloudFront signed URL.

upvoted 0 times

...