ANS-C01 Question 316
Select 3Your company is hosting a multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances for the web tier, and a private Amazon RDS database for the database tier. To meet compliance requirements, you need to ensure that all traffic to the web tier is encrypted and that only the ALB can communicate with the EC2 instances. How can you achieve this?
- A
Configure the ALB to use HTTPS listeners and associate an SSL/TLS certificate.
- B
Enable end-to-end encryption by using HTTPS between the ALB and EC2 instances.
- C
Set up a security group for the EC2 instances that only allows inbound traffic from the ALB's security group.
- D
Use a Network Load Balancer (NLB) instead of an ALB to enforce encryption.
- E
Configure the EC2 instances to terminate SSL/TLS traffic.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet compliance requirements for traffic encryption to the web tier, you need to configure HTTPS on the ALB and ensure end-to-end encryption by enabling HTTPS communication between the ALB and EC2 instances. Additionally, restricting access to the EC2 instances using security groups ensures that only the ALB can communicate with them, preventing direct access from other sources. Using an NLB or terminating SSL/TLS directly on the EC2 instances does not align with the scenario's requirements or best practices.
- A. Correct.
Correct. Configuring the ALB to use HTTPS listeners and associating an SSL/TLS certificate ensures all incoming traffic to the ALB is encrypted.
- B. Correct.
Correct. Enabling HTTPS between the ALB and EC2 instances ensures end-to-end encryption, satisfying the compliance requirement.
- C. Correct.
Correct. Restricting inbound traffic to the EC2 instances so that only the ALB's security group can communicate with them ensures that no other source can access the instances directly.
- D. Incorrect.
Incorrect. While an NLB supports encryption using TLS, it is not suitable for application-layer decisions that an ALB is designed for in this scenario.
- E. Incorrect.
Incorrect. Terminating SSL/TLS traffic on the EC2 instances would require additional configuration and does not provide a centralized point of management for SSL/TLS certificates.