A media company sells premium videos served via CloudFront. Videos must be accessible only to paying subscribers for a limited time. Which mechanism enforces this?
A.Signed URLs or signed cookies generated by the application
Correct. Signed URLs/cookies are CloudFront's built-in gated-access mechanism.
B.HTTPS on the CloudFront distribution
HTTPS encrypts transport but doesn't restrict who can fetch content.
C.Geo-restriction on the distribution
Geo-restriction filters by country, not by subscriber status.
D.A WAF rule blocking bots
WAF blocks attack patterns, not unpaid legitimate requests.
Why this answer
CloudFront signed URLs/cookies embed an encrypted policy (expiry, allowed IP ranges, etc.) in the request. Content stays private at the edge until the application issues a signed grant — exactly the paid-content access-control pattern.
Correct answer: A · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption