Exam AWS Certified Developer Associate topic 1 question 7 discussion

B seems to be correct

C) - Eliminated - Amazon CloudFront does not have a direct, built-in authentication mechanism. While you could use Lambda@Edge to enforce authentication with Cognito, this approach would be unnecessarily complex

I think so B because origin is ALB and we need to provide authentication to origin ALB, Cognito is for authentication provider.

It is possible to integrate Amazon Cognito User Pools with a load balancer in order to provide an authentication system before the ALB is called. It is also possible to configure the auth page by adding a logo if you want or use a third-part system to autenticate like Google or Facebook. So, we need to: - Create an user pool - Create an user pool client - Create a pool domain name - Federate with social - Configure the DNS - Congigure a callback URL to point the ALB URL (in case of successful login) (https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#cognito-requirements)

i thing is B

It should be B

Its B https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html

https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/

B is correct. You cannot directly integrate Cognito User Pools with CloudFront distribution as you have to create a separate Lambda@Edge function to accomplish the authentication via Cognito User Pools.

could be D https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-how-to-use-lambdaedge-and-json-web-tokens-to-enhance-web-application-security/ "In the Outputs section, look for LambdaAtEdgeFunction with the URL for editing the Lambda function, similar to the screenshot below."

ALB’s new authentication action provides authentication through social Identity Providers (IdP) like Google, Facebook, and Amazon through Amazon Cognito. It also natively integrates with any OpenID Connect protocol compliant IdP, providing secure authentication and a single sign-on experience across your applications. https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/

I think the answer is D https://aws.amazon.com/ko/blogs/security/protect-public-clients-for-amazon-cognito-by-using-an-amazon-cloudfront-proxy/

Why it can't be C?