AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 203

Question

A company is using an Amazon CloudFront distribution to deliver content from two origins. One origin is a dynamic application that is hosted on Amazon EC2 instances. The other origin is an Amazon S3 bucket for static assets. A security analysis shows that HTTPS responses from the application do not comply with a security requirement to provide an X-Frame-Options HTTP header to prevent frame-related cross-site scripting attacks. A security engineer must make the full stack compliant by adding the missing HTTP header to the responses. Which solution will meet these requirements?

Accepted Answer

Correct answer: A. The correct answer is A. Option A: Create a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront origin response event. AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Config tracks resource configuration changes and evaluates compliance.

AWS Certified Security - Specialty SCS-C02 — Question 203