Your organization is using a CloudFront distribution to distribute content from an S3 bucket. It is required that only a particular set of users get access to certain objects respectively. How could this be accomplished?

Answer options:

A.Create IAM Users for each user and then provide access to the S3 bucket content.
B.Create an IAM Group for each set of users and then provide each Group access to the S3 bucket.
C.Create CloudFront signed URLs and then distribute these URLs to the users.
D.Use IAM Polices for the underlying S3 buckets to restrict content.

Correct Answer - C
AWS Documentation mentions the following: 
CloudFront signed URLs and signed cookies provide the same basic functionality: they allow you to control who can access your content. 
Use signed URLs in the following cases:
You want to restrict access to individual files, for example, an installation download for your application.
Your users are using a client (for example, a custom HTTP client) that doesn`t support cookies.
Use signed cookies in the following cases:
You want to provide access to multiple restricted files, for example, all of the files for a video in HLS format or all of the files in the subscribers` area of the website.
You don`t want to change your current URLs.
Reference:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-choosing-signed-urls-cookies.html