AWS SAA-C03 #172

A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer of security. The sensitive information should.be protected throughout the entire application stack, and access to the information should be restricted to certain applications.

Which action should the solutions architect take?

A. Configure a CloudFront signed URL.
B. Configure a CloudFront signed cookie.
C. Configure a CloudFront field-level encryption profile.
D. Configure CloudFront and set the Origin Protocol Policy setting to HTTPS Only for the Viewer Protocol Policy.

---

The solution architect should take action C: Configure a CloudFront field-level encryption profile.

Field-level encryption is a feature of CloudFront that allows you to securely upload user-submitted data, such as credit card numbers or personal health information, to your servers. With field-level encryption, sensitive information is encrypted at CloudFront edge locations close to the user, and only decrypted at your origin. This ensures that sensitive information is protected throughout your entire application stack and restricts access to certain applications.

Options A and B, configuring a CloudFront signed URL or cookie, are primarily used for controlling who can access your content, not for encrypting sensitive data. Option D, setting the Origin Protocol Policy to HTTPS Only for the Viewer Protocol Policy, ensures that traffic between CloudFront and your origin server is encrypted, but it does not provide an additional layer of security for sensitive data within the application stack.

Therefore, option C is the most suitable for this scenario.