How to Configure CloudFront for Encryption in Transit?

DVA-C02 By islever Editorial Last updated

Short answer

BE Set the Origin Protocol Policy setting to Match Viewer. Set the Viewer Protocol Policy setting to Redirect HTTP to HTTPS.

Question

A developer is writing a web application that is deployed on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The developer must add an Amazon CloudFront distribution in front of the ALB. The developer also must ensure that customer data from outside the VPC is encrypted in transit. Which combination of CloudFront configuration settings should the developer use to meet these requirements? (Choose two.)
  1. Restrict viewer access by using signed URLs.
  2. Set the Origin Protocol Policy setting to Match Viewer. Correct Answer
  3. Enable field-level encryption.
  4. Enable automatic object compression.
  5. Set the Viewer Protocol Policy setting to Redirect HTTP to HTTPS. Correct Answer

Key Takeaways

Tests understanding of CloudFront's dual protocol policies to enforce encryption without creating caching loops or protocol mismatches.

Configuring Amazon CloudFront to encrypt data in transit requires aligning viewer and origin protocol policies. The community consensus confirms that combining redirect HTTP to HTTPS with match viewer ensures secure connections for all external requests.

Common mistake: Option A is frequently selected incorrectly because candidates confuse access restriction mechanisms with network-level transit encryption, which signed URLs do not provide.

Expert Analysis

Why the Answer Is Correct

Setting the Viewer Protocol Policy to Redirect HTTP to HTTPS guarantees that all client-to-CloudFront traffic is encrypted before reaching the edge. Pairing this with the Origin Protocol Policy set to Match Viewer instructs CloudFront to automatically use HTTPS when fetching content from the ALB, provided the viewer initially connected securely. This coordinated configuration fully satisfies the requirement to encrypt customer data in transit across both network segments.

Why the Other Options Are Wrong

Signed URLs restrict who can access specific resources but leave the underlying transport layer unencrypted. Field-level encryption only protects individual form fields inside POST payloads rather than securing the entire communication channel. Automatic object compression optimizes bandwidth for static assets like CSS or JavaScript files without adding any cryptographic protections. None of these alternatives address the fundamental need for transit encryption.

Community Comment Notes

Contributors consistently reference official AWS documentation to validate that Match Viewer must be paired with HTTPS redirection to prevent protocol errors while preserving cache efficiency [Comment 1]. Multiple users emphasize that CloudFront intelligently caches responses once regardless of whether the viewer originally used HTTP or HTTPS, making this pairing both secure and performant [Comment 2]. The discussion reinforces that selecting both options simultaneously creates a seamless encrypted pipeline from the internet to the ALB [Comment 3].

Official Reference

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always map security requirements to the specific CloudFront policy type they control, distinguishing between edge-to-client visibility and origin-fetching behavior. When encryption in transit is mandated, prioritize configurations that enforce HTTPS at the viewer level while dynamically matching protocols toward the backend to avoid unnecessary cache misses.

Community Votes

BE
100%

100% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. KarBiswa 👍 6
    https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html
  2. KennethNg923 👍 2
    B. Set the Origin Protocol Policy setting to Match Viewer. then if it is HTTP, Viewer Protocol Policy setting can Redirect HTTP to HTTPS (Option E).
  3. aws_god 👍 1
    Choose Match Viewer only if you specify Redirect HTTP to HTTPS or HTTPS Only for Viewer Protocol Policy. CloudFront caches the object only once even if viewers make requests using both HTTP and HTTPS protocols. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html
  4. chigs508 👍 1
    a public discussion thread on this question
  5. 65703c1 👍 1
    BE is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide