Explanation

Correct Answer: B - Generate and provide CloudFront signed URLs to premium customers.

Why this is correct:

1. CloudFront signed URLs are specifically designed for content delivery scenarios where you want to restrict access to content through CloudFront distributions.

2. The requirements include:

   • Only premium customers should have access
   • Content is delivered via CloudFront distribution
   • Content stored in S3 bucket
   • On-demand delivery for specific purposes (movie rentals, music downloads)

3. CloudFront signed URLs provide:

   • Time-limited access (perfect for rentals/downloads)
   • Secure access control at the CDN level
   • Integration with CloudFront's caching infrastructure
   • Ability to restrict access to specific IP addresses, paths, or time periods

Why other options are incorrect:

A. Generate and provide S3 signed cookies to premium customers.

• S3 signed cookies work at the S3 level, not CloudFront level
• This would bypass CloudFront's caching and delivery optimization
• Less suitable for time-limited access scenarios like rentals

C. Use origin access control (OAC) to limit the access of non-premium customers.

• OAC restricts access from CloudFront to S3 origin
• This prevents direct access to S3 but doesn't control which end-users can access CloudFront content
• All users would still be able to access CloudFront content

D. Generate and activate field-level encryption to block non-premium customers.

• Field-level encryption is for encrypting specific form fields in HTTP requests
• Not relevant for restricting access to media streams and file content
• Doesn't address the access control requirement

Key AWS Concepts:

• CloudFront Signed URLs/URLs: Create time-limited URLs that grant access to CloudFront content
• Use Case: Perfect for pay-per-view, rentals, or premium content access
• Integration: Works seamlessly with S3 origins while maintaining CloudFront benefits
• Security: URLs can be generated server-side and provided only to authorized users