Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 152 discussion

Option A: CloudFront does not use certificates stored in AWS Certificate Manager (ACM) in the us-west-2 region. It uses certificates stored in the us-east-1 region, making this option incorrect. Option C: This is incorrect because the private key should not be uploaded to CloudFront for field-level encryption. Instead, the public key is used. A private key must remain confidential and not exposed or uploaded to public services. Option D: This option incorrectly suggests that the field-level encryption profile should be linked to GET requests. Field-level encryption is used for encrypting sensitive information coming in POST requests (like form submissions with credit card details), not for GET requests. Therefore, this option is incorrect.

The answer is B and E. Rationale: B ensures proper certificate management E implements field-level encryption for sensitive data like credit card numbers Using POST requests is more secure for sending sensitive information Public key encryption ensures only authorized components can decrypt

AE - The Cert, ALB, and CFD should all be in the same region.

For A and B. To use a certificate in AWS Certificate Manager (ACM) to require HTTPS between viewers and CloudFront, make sure you request (or import) the certificate in the US East (N. Virginia) Region (us-east-1). If you want to require HTTPS between CloudFront and your origin, and you’re using a load balancer in Elastic Load Balancing as your origin, you can request or import the certificate in any AWS Region. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html

Correct answer BE A is wrong due to cloudfront stores certs in us-east-1 not us-west-2 C is wrong due to the private key (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html) D is wrong because of the get requests as it should be post requests

Option B is incorrect because it suggests uploading the certificate for the CloudFront distribution into ACM in a different region, which is not necessary and can complicate management. Option A is correct as it suggests importing the third-party certificate directly into ACM in the same region where the ALB is deployed. This simplifies certificate management and allows you to associate the certificate with the ALB. Option E is the correct choice for configuring field-level encryption (FLE). It involves uploading the public key that handles encryption of the sensitive data to the CloudFront distribution, creating a field-level encryption profile to specify the fields containing sensitive information, and then creating a field-level encryption configuration and linking it to the appropriate cache behavior associated with sensitive POST requests. This ensures that sensitive data is encrypted at the field level before being sent to the application components.

BE - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html