A company uses Amazon CloudFront with two origins: a dynamic application on Amazon EC2 and an Amazon S3 bucket for static content. A security review found that HTTPS responses from the application are missing the X-Frame-Options HTTP header required to mitigate clickjacking. A security engineer must ensure the entire stack is compliant by adding the header to responses. Which approach meets this requirement?

The correct approach is to deploy a Lambda@Edge function triggered by the CloudFront origin response event. This allows you to inspect and modify the response coming from either origin (EC2 or S3) before it's cached and delivered to the viewer. Adding the header at this stage ensures consistent application across both origins without modifying the application code or S3 objects directly. Triggering on the viewer request event is incorrect because the header needs to be added to the response, not the request. Updating CloudFront distribution origin settings to add a custom header is for forwarding headers to the origin, not adding them to the response from the origin. Modifying the EC2 application is only a partial solution, as it wouldn't address responses from the S3 origin.