SAP-C03 practice question: Ingress, edge functions and real-time APIs (ALB, NLB, API Gateway, CloudFront)

Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A streaming news site serves most of its article pages from Amazon CloudFront. Readers who hold a paid subscription have a signed subscriber cookie, and non-subscribers must be redirected to the subscription page before they can read a paywalled article.

The check must run on every viewer request, including requests that CloudFront could otherwise answer from its cache. It must add almost no latency, and the team wants no network call to a subscription service on each request.

Which solution meets these requirements at the LOWEST cost?

Choose one answer.

A. Attach a CloudFront Function to the viewer request event that reads the subscriber cookie and returns a redirect to the subscription page when the cookie is missing or invalid.
B. Attach a Lambda@Edge function to the origin request event that checks the subscriber cookie against the subscription service.
C. Move the check to the origin by placing an Application Load Balancer with an OIDC authentication action in front of the site, so every request is authenticated before it reaches the content.
D. Attach a Lambda@Edge function to the viewer request event that looks up the reader's subscription status in a DynamoDB table on every request.

Show the answer and explanation

Answer: A

A. Right: Correct. CloudFront Functions run on every viewer request at the edge with very low latency and cost, and they can read cookies and return redirects without a network call. This covers cached and uncached requests alike.
B. Wrong: The origin request event runs only when CloudFront forwards a request to the origin, so cached article pages would be served without the check. The function also makes a network call on each cache miss.
C. Wrong: Authentication at the origin means every request, including those that could be cached, reaches the load balancer. That raises origin load and cost, and it adds latency that the edge check avoids.
D. Wrong: This check does run on every viewer request, so it meets the coverage need. The per-request network call to DynamoDB adds latency and cost, which breaks the requirement to add almost no latency and avoid network calls.

Explanation

The check has to run on every viewer request, with almost no latency and no network call, so the viewer request event and a CloudFront Function fit. Origin request logic misses cache hits, and the other options add origin load or a network call on every request.

SAP-C03 practice question: Ingress, edge functions and real-time APIs (ALB, NLB, API Gateway, CloudFront)

Explanation

Study

Keep practicing