You must deliver protected digital assets to authorized users via Amazon CloudFront while preventing public access. Which configuration satisfies this requirement?

The correct configuration involves storing objects in an S3 bucket with public access blocked to ensure they are not directly accessible. An Origin Access Identity (OAI) for CloudFront then grants CloudFront permission to retrieve objects from this private S3 bucket. Finally, CloudFront signed URLs are used to provide time-limited access to authorized users, fulfilling the requirement for protected digital assets. The first incorrect option fails because allowing public S3 access defeats the purpose of protecting assets. The third incorrect option incorrectly mentions field-level encryption, which is unrelated to restricting access to the S3 origin. The fourth option is incorrect because while signed cookies can restrict delivery, the S3 bucket allowing public access still leaves the assets vulnerable to direct access, bypassing CloudFront.