Create an Amazon Cognito identity pool, enable unauthenticated identities, and assign an IAM role that allows s3:GetObject on the bucket is correct because the identity pool issues temporary AWS credentials for guests and the unauthenticated IAM role can be scoped to allow only read access to the S3 objects so visitors can view images without signing in and without making the bucket public.

An identity pool provides temporary AWS credentials that the web frontend can obtain for unauthenticated users and those credentials are mapped to a least privilege IAM role. This lets the app call S3 directly for read only access while keeping other resources protected. The existing Cognito user pool can still handle signed in users while the identity pool issues credentials for both authenticated and unauthenticated identities.

Create a Cognito user pool and add a placeholder guest account, then attach S3 read permissions to that user is incorrect because user pools handle authentication and provide tokens and they do not issue AWS credentials or map directly to IAM roles for service access.

Use Amazon CloudFront signed URLs to deliver the S3 images to unauthenticated visitors is not the best fit because signed URLs control distribution level access and they do not provide general AWS credentials for the application to call other AWS services or integrate with Cognito identity features.

Create a new Cognito user pool, disable sign-in requirements, and grant access to AWS resources is incorrect because user pools do not support unauthenticated identities and they cannot directly grant IAM permissions the way an identity pool can.

Full AWS Practitioner Certification Question