How Do You Enforce HTTPS for a CloudFront Custom Domain on AWS?
A company is building a web application on AWS. The company is using Amazon CloudFront with a domain name of www.example.com. All traffic to CloudFront must be encrypted in transit. The company already has provisioned an SSL certificate for www.example.com in AWS Certificate Manager (ACM). Which combination of steps should a CloudOps engineer take to encrypt the traffic in transit? (Choose two.)
Community Insight
The exam tests that HTTPS on CloudFront is a two-part configuration — a matching custom certificate on an alternate domain name plus a per-cache-behavior Viewer Protocol Policy — and the trap is assuming one of the two alone secures viewer traffic.
CloudFront encrypts viewer traffic only when the distribution serves a valid certificate for www.example.com and every cache behavior refuses plain HTTP. This page confirms that the required pair of steps is creating the alternate domain name with the ACM certificate and setting each Viewer Protocol Policy to redirect HTTP to HTTPS.
Choosing option B because 'allow HTTP and HTTPS' sounds flexible; it still permits unencrypted requests to reach CloudFront, so it fails the requirement that all traffic be encrypted in transit.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CloudFront encrypts traffic between viewers and edge locations only if two independent things are true, and options A and C supply exactly those two things. Option C attaches www.example.com to the distribution as an alternate domain name (CNAME) and binds the ACM-issued custom certificate, so the edge can complete a TLS handshake for that hostname instead of falling back to the default *.cloudfront.net certificate. Option A then forces the protocol decision at the edge: setting the Viewer Protocol Policy to Redirect HTTP to HTTPS on every cache behavior guarantees no viewer can complete a request over plaintext HTTP. Because CloudFront evaluates Viewer Protocol Policy per cache behavior, the setting must be applied to all of them, which is why the option is phrased 'for each cache behavior'. Together, C makes HTTPS possible for the custom domain and A makes it mandatory, which is precisely the requirement that all traffic be encrypted in transit. Community member Bad_Mat reached the same conclusion, stating "The correct combination of steps is A and C."
Why the Other Options Are Wrong
Option B is the classic distractor: allowing both HTTP and HTTPS leaves an unencrypted path open, so any viewer (or an attacker rewriting links) can still send cleartext requests, violating the 'all traffic must be encrypted' requirement. Option D is unrelated to transport encryption — an AWS WAF web ACL filters malicious requests at layer 7 and does not change the TLS or HTTP/HTTPS behavior of the distribution. Option E is also unrelated: Origin Shield adds a centralized caching layer between edge locations and the origin to reduce origin load and improve cache hit ratio, but it has no effect on the viewer-to-edge protocol. Neither D nor E supplies the certificate binding or the HTTP-to-HTTPS redirect that the scenario demands.
Community Comment Notes
The only recorded learner input on this item, from Bad_Mat, endorses the same pairing of steps (A and C), which matches what the CloudFront console actually enforces. That agreement is a sanity check rather than the reason to choose: the decisive evidence is that the scenario names an existing ACM certificate for www.example.com, which is otherwise unusable unless the hostname is added as an alternate domain name. Note also that ACM certificates used with CloudFront must reside in us-east-1, a detail worth remembering when a scenario mentions a certificate that will not attach.
Official Reference
Exam Strategy
When a CloudFront requirement mentions encryption in transit for a custom domain, immediately look for the pair: redirect HTTP to HTTPS on the cache behaviors plus an alternate domain name bound to the ACM certificate. Eliminate any option about WAF, Origin Shield, or 'allow HTTP and HTTPS' before you start weighing the remaining choices.
Frequently Asked Questions
Why is 'allow HTTP and HTTPS' wrong for a CloudFront distribution that must be encrypted?
It leaves a plaintext path open, so viewers can still reach CloudFront over HTTP. Only the Redirect HTTP to HTTPS policy guarantees every request is encrypted in transit.
Why must www.example.com be added as an alternate domain name instead of just using the ACM certificate?
CloudFront only presents a custom certificate for hostnames listed as alternate domain names; otherwise it serves the default cloudfront.net certificate and the browser shows a name mismatch.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →