ANS-C01 Question 451
Select 3An organization is deploying a web application on AWS that requires secure communication between its frontend hosted on Amazon CloudFront and backend hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application also handles sensitive customer data and needs to ensure encryption during data transit and validation of data integrity. Which combination of mechanisms should be implemented to secure the application flows?
- A
Enable HTTPS on CloudFront and ALB using TLS certificates issued by AWS Certificate Manager (ACM)
- B
Use AWS WAF to block malicious traffic and inspect HTTP requests before they reach the backend
- C
Configure encryption between CloudFront and ALB using a custom HTTPS Origin Protocol Policy
- D
Enable Cross-Origin Resource Sharing (CORS) to control access between the frontend and backend
- E
Enable Perfect Forward Secrecy (PFS) for the TLS connection between CloudFront and ALB
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure application flows, it is critical to implement HTTPS for encrypted communication, enforce encryption between all components of the application flow, and adopt advanced TLS features like Perfect Forward Secrecy to protect session keys. While AWS WAF and CORS are valuable for specific use cases, they do not directly address the encryption and integrity of application flows, which is the focus of this question.
- A. Correct.
Correct: Enabling HTTPS and using ACM certificates ensures encrypted communication between CloudFront and ALB, securing the application flow from end-users to your backend systems.
- B. Incorrect.
Incorrect: While AWS WAF is useful for blocking malicious traffic, it doesn't directly secure data in transit or ensure encryption and integrity of the application flow.
- C. Correct.
Correct: Configuring a custom HTTPS Origin Protocol Policy ensures encryption for the connection between CloudFront and the ALB, further securing the data in transit.
- D. Incorrect.
Incorrect: CORS is used to control resource sharing between domains but does not provide encryption or data integrity for application flows.
- E. Correct.
Correct: Enabling Perfect Forward Secrecy (PFS) enhances the security of the TLS connection by ensuring that session keys cannot be compromised even if the server's private key is exposed.