A media company uses an Amazon CloudFront distribution to deliver content over the internet. Only premium customers should be able to access media streams and files stored in an Amazon S3 bucket. The company also delivers content on demand for specific uses, such as movie rentals or music downloads. Which solution meets these requirements?

CloudFront signed URLs are the correct solution because they allow you to control access to individual files or streams for a limited time. This directly addresses the need for premium customer access and on-demand content delivery, as you can generate unique, time-limited URLs for each premium customer or rental. S3 signed cookies are incorrect because while they can grant temporary access, they are typically used for a group of files or a directory, not individual on-demand content, and are less granular than signed URLs for specific content access. Using origin access control (OAC) is incorrect because OAC secures the connection between CloudFront and S3, preventing direct S3 access. It doesn't provide a mechanism to differentiate access between premium and non-premium CloudFront users. Field-level encryption is incorrect because it encrypts specific data fields within a request. It is a security feature for sensitive data in transit and has no bearing on controlling user access to content based on premium status.