The correct answer is: Create a private Amazon S3 bucket. Use a bucket policy to allow access from a CloudFront origin access identity (OAI). Upload content by using the AWS CLI.

Amazon S3 is the most cost-effective and resilient choice for hosting static content. Configuring the bucket as private and allowing access only through CloudFront via an origin access identity (OAI) improves security. Though the administrator currently uses SFTP, transitioning to the AWS CLI or an S3-compatible client for uploads is straightforward and minimizes costs and operational overhead.

Why the other options are incorrect:

Amazon Lightsail with a virtual server introduces unnecessary compute resources and ongoing costs. While it supports SFTP uploads, it does not provide the same durability or scalability as Amazon S3 and does not align with a static sites needs.

EC2 with Auto Scaling and a load balancer is overly complex and expensive for serving static documents. This architecture is meant for dynamic applications and is not suitable for a low-traffic, static marketing website.

Using a public S3 bucket with AWS Transfer for SFTP allows for SFTP uploads, but public S3 buckets are discouraged due to security risks. S3 static website hosting does not support HTTPS unless served through CloudFront, and using public buckets weakens access controls compared to private buckets with OAI.

Why this question matters: This scenario tests the ability to choose a simple, secure, and cost-efficient hosting solution for static content behind CloudFront. It highlights the importance of private S3 bucket configuration and modern content delivery practices.

Tip: For static websites on AWS with CloudFront, private S3 buckets with OAI are almost always the correct choice. Transitioning from SFTP to CLI uploads is common and lowers long-term operational burden.

Full AWS Practitioner Certification Question