ANS-C01 Question 492
Single answerYour company hosts a multi-tier application on AWS with an Auto Scaling group for the web tier, an Application Load Balancer (ALB), and a backend database in Amazon RDS. You want to ensure that traffic between the ALB and the Auto Scaling instances is encrypted, while also minimizing operational overhead. Which solution will best meet this requirement?
- A
Use an HTTPS listener on the ALB and enable server-side encryption on the Auto Scaling instances.
- B
Use an HTTPS listener on the ALB and configure SSL/TLS certificates on the Auto Scaling instances.
- C
Use a TCP listener on the ALB and terminate SSL at the Auto Scaling instances.
- D
Use an HTTPS listener on the ALB and enable AWS Certificate Manager (ACM) to manage SSL/TLS certificates.
Show answer and explanation
Correct answer: D
Explanation
To encrypt traffic between the ALB and Auto Scaling instances, an HTTPS listener is required. By integrating AWS Certificate Manager (ACM) with the ALB, you can manage SSL/TLS certificates without manual overhead, ensuring secure and efficient operations. This option provides both encryption and automation, fulfilling the requirements while minimizing complexity.
- A. Incorrect.
This option is incorrect because server-side encryption refers to encrypting data at rest, not traffic between the ALB and the instances.
- B. Incorrect.
While this solution would encrypt the traffic, it requires manually installing and managing SSL/TLS certificates on the Auto Scaling instances, increasing operational overhead.
- C. Incorrect.
Using a TCP listener does not support SSL termination at the ALB, and traffic between the ALB and instances would not be encrypted.
- D. Correct.
This is the correct solution because an HTTPS listener on the ALB ensures encrypted traffic, and AWS Certificate Manager (ACM) can automate SSL/TLS certificate provisioning and renewal, reducing operational overhead.