A company has a web application to distribute contents to their customers around the globe and wants to restrict access to contents that are intended for selected users. They’ve decided to use AWS CloudFront. Which of the following methods are suitable to achieve the requirement? (SELECT TWO.)

Answer options:

A.Create an origin access identity.
B.Create CloudFront signed URLs.
C.Create IAM Resource policy granting CloudFront access.
D.Create CloudFront signed cookies.
E.Create CloudFront Service Endpoint.

Answer: B and D
Option A is incorrect because origin access identity is used when content from Amazon S3 can only be served through CloudFront.
Option B is CORRECT because CloudFront signed URLs allow you to control who can access your content.
Option C is incorrect because IAM resource policy is not required in this scenario.
Option D is CORRECT because CloudFront signed URLs and signed cookies provide the same basic functionality: they allow you to control who can access your content.
Option E is incorrect because CloudFront does not have a service endpoint.
Reference:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-overview.html