How to Configure CloudFront for Encryption in Transit?
A developer is writing a web application that is deployed on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The developer must add an Amazon CloudFront distribution in front of the ALB. The developer also must ensure that customer data from outside the VPC is encrypted in transit. Which combination of CloudFront configuration settings should the developer use to meet these requirements? (Choose two.)
Community Votes
100% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests understanding of CloudFront's dual protocol policies to enforce encryption without creating caching loops or protocol mismatches.
Configuring Amazon CloudFront to encrypt data in transit requires aligning viewer and origin protocol policies. The community consensus confirms that combining redirect HTTP to HTTPS with match viewer ensures secure connections for all external requests.
Option A is frequently selected incorrectly because candidates confuse access restriction mechanisms with network-level transit encryption, which signed URLs do not provide.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Setting the Viewer Protocol Policy to Redirect HTTP to HTTPS guarantees that all client-to-CloudFront traffic is encrypted before reaching the edge. Pairing this with the Origin Protocol Policy set to Match Viewer instructs CloudFront to automatically use HTTPS when fetching content from the ALB, provided the viewer initially connected securely. This coordinated configuration fully satisfies the requirement to encrypt customer data in transit across both network segments.Why the Other Options Are Wrong
Signed URLs restrict who can access specific resources but leave the underlying transport layer unencrypted. Field-level encryption only protects individual form fields inside POST payloads rather than securing the entire communication channel. Automatic object compression optimizes bandwidth for static assets like CSS or JavaScript files without adding any cryptographic protections. None of these alternatives address the fundamental need for transit encryption.Community Comment Notes
Contributors consistently reference official AWS documentation to validate that Match Viewer must be paired with HTTPS redirection to prevent protocol errors while preserving cache efficiency [Comment 1]. Multiple users emphasize that CloudFront intelligently caches responses once regardless of whether the viewer originally used HTTP or HTTPS, making this pairing both secure and performant [Comment 2]. The discussion reinforces that selecting both options simultaneously creates a seamless encrypted pipeline from the internet to the ALB [Comment 3].Official Reference
Exam Strategy
Always map security requirements to the specific CloudFront policy type they control, distinguishing between edge-to-client visibility and origin-fetching behavior. When encryption in transit is mandated, prioritize configurations that enforce HTTPS at the viewer level while dynamically matching protocols toward the backend to avoid unnecessary cache misses.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →