A company needs to improve the security of its web application on AWS.

Option C is correct. For an internet-facing Application Load Balancer used as a CloudFront custom origin, AWS recommends configuring CloudFront to add a custom HTTP header to origin requests and configuring the ALB listener rules to forward only requests that contain that specific header. This prevents users from bypassing CloudFront and accessing the ALB directly, while still allowing legitimate CloudFront-originated traffic. AWS also warns that the header name and value must remain secret and should be protected with HTTPS. Option A is incomplete because security groups cannot restrict traffic to one specific CloudFront distribution. Option B does not reliably stop direct ALB access. Option D is wrong because CloudFront origin access control is primarily for supported AWS origins such as S3 origins, not this ALB custom-origin control pattern.