Your company is planning to use an S3 bucket and a CloudFront distribution to distribute objects to users worldwide. They want to use their own domain name with the CloudFront distribution and ensure that the communication is secure. Which of the following steps need to be part of the implementation plan? (Select TWO.)

Answer options:

A.Change the Viewer protocol Policy to require HTTPS between viewers and CloudFront.
B.Import an SSL certificate to ACM and use the certificate in the CloudFront distribution.
C.Create a KMS CMK Key and use the key in the CloudFront distribution.
D.Apply CORS for the CloudFront distribution.

Answer – A and B
This is mentioned in the AWS Documentation.
· If you`re using the domain name that CloudFront assigned to your distribution, such as d111111abcdef8.cloudfront.net, you change the Viewer Protocol Policy setting for one or more cache behaviors to require HTTPS communication. In that configuration, CloudFront provides the SSL/TLS certificate.
To change the value of Viewer Protocol Policy by using the CloudFront console, see the procedure later in this section.
· If you`re using your own domain name, such as example.com, you need to change several CloudFront settings. You also need to use an SSL/TLS certificate provided by AWS Certificate Manager (ACM), import a certificate from a third-party certificate authority into ACM or the IAM certificate store.
Option C is incorrect since you need to use SSL certificates and not KMS keys.
Option D is incorrect since CORS is used for access between domains.
For more information on using CNAMEs and HTTPs, please visit the below URL
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html