Amazon Web Services SCS-C02 Exam With Confidence Using Practice Dumps

To ensure that application content is accessible only through CloudFront and not directly, the security engineer should do the following:

Add an origin custom header. This is a header that CloudFront adds to the requests that it sends to the origin, but viewers cannot see or modify.

Set the viewer protocol policy to redirect HTTP to HTTPS. This ensures that the viewers always use HTTPS when they access the website through CloudFront.

Set the origin protocol policy to HTTPS only. This ensures that CloudFront always uses HTTPS when it connects to the origin.

Update the application to validate the CloudFront custom header. This means that the application checks if the request has the custom header and only responds if it does. Otherwise, it denies or ignores the request. This prevents users from bypassing CloudFront and accessing the content directly on the origin.

KMS grants are lightweight and efficient tools designed specifically for programmatic, temporary, or high-volume delegation of KMS key usage. They are ideal when access needs to be rotated or updated frequently—such as weekly changes in vendors.

KMS grants allow you to control access without changing the key policy itself. They can be easily created and revoked programmatically, which minimizes operational overhead compared to editing key or IAM policies.

This approach aligns with Identity and Access Management best practices in the AWS Certified Security – Specialty study guide for scalable cross-account key access management.

Amazon EC2 Systems Manager is a service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems3. You can use Systems Manager to report on instance patch compliance and enforce updates during the defined maintenance windows4. The other options are either inefficient or not feasible for achieving the goals.