ANS-C01 Question 488
Select 3Your organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data, and compliance requirements mandate that all data in transit must be encrypted. How can you ensure confidentiality of data and communications across the network?
- A
Use an SSL/TLS certificate on the Application Load Balancer to enforce HTTPS for client connections.
- B
Configure the EC2 instances to use plaintext HTTP for communication with the Application Load Balancer to reduce latency.
- C
Enable end-to-end encryption by configuring SSL/TLS termination at the Application Load Balancer and re-encrypting traffic to the EC2 instances.
- D
Use a Network Load Balancer instead of an Application Load Balancer to ensure better security for data in transit.
- E
Implement AWS Certificate Manager (ACM) to manage and provision SSL/TLS certificates for the Application Load Balancer.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the compliance requirements for encrypted data in transit, you must enforce HTTPS on the ALB using SSL/TLS certificates, ensure end-to-end encryption (client to ALB, ALB to EC2 instances), and use AWS Certificate Manager to manage SSL/TLS certificates effectively. Configuring plaintext HTTP or relying on a Network Load Balancer does not address the need for encryption and confidentiality.
- A. Correct.
Correct: Using an SSL/TLS certificate on the Application Load Balancer ensures that HTTPS is enforced for traffic between clients and the load balancer, encrypting data in transit.
- B. Incorrect.
Incorrect: Using plaintext HTTP for communication with the Application Load Balancer violates the compliance requirement for encrypted data in transit, and it exposes sensitive data to potential attackers.
- C. Correct.
Correct: Enabling end-to-end encryption ensures that data remains encrypted not only between the client and the ALB but also between the ALB and the EC2 instances, meeting the confidentiality requirement.
- D. Incorrect.
Incorrect: While Network Load Balancers are useful for certain use cases, they do not inherently provide better security for data in transit compared to Application Load Balancers. ALBs support SSL/TLS encryption effectively.
- E. Correct.
Correct: AWS Certificate Manager simplifies the management of SSL/TLS certificates, ensuring proper implementation of encryption and easing certificate renewal processes.