Your company currently has a web distribution hosted using the AWS CloudFront service. The IT Security department has confirmed that the application using this web distribution now falls under the scope of PCI (Payment Card Industry) compliance. What are the necessary steps to be followed before auditing? (SELECT TWO)

Answer options:

A.Enable CloudFront access logs.
B.Enable Cache in CloudFront.
C.Capture requests that are sent to the CloudFront API.
D.Enable VPC Flow Logs

Correct Answer – A and C
AWS Documentation mentions the following:
If you run PCI or HIPAA-compliant workloads based on the AWS Shared Responsibility Model, we recommend that you log your CloudFront usage data for the last 365 days for future auditing purposes. Third-party auditors assess the security and compliance of Amazon CloudFront as part of multiple AWS compliance programs. 
Option B is incorrect. It helps to reduce latency.
Option D is incorrect. VPC flow logs capture information about the IP traffic going to and from network interfaces in a VPC but not for CloudFront.
For more information on compliance with CloudFront, please visit the following URLs:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
https://aws.amazon.com/blogs/aws/pci-compliance-for-amazon-cloudfront/
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SERVICENAME-compliance.html