ANS-C01 Question 95
Select 2You are designing a secure web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The organization requires end-to-end encryption for sensitive data and strict authentication between clients and the backend servers. Which configuration ensures compliance with these requirements?
- A
Configure the ALB for TLS termination and re-encrypt traffic to the backend using a custom server certificate.
- B
Enable TLS passthrough on the ALB to maintain encryption between clients and backend servers.
- C
Use a Network Load Balancer (NLB) instead of an ALB for end-to-end TLS passthrough.
- D
Configure the ALB for TLS termination, and use plaintext traffic between the ALB and the backend servers.
- E
Use mutual TLS authentication on the ALB to verify both client and backend server certificates.
Show answer and explanation
Correct answers: A, E
Explanation
To achieve end-to-end encryption and strict authentication, you should configure the ALB for TLS termination and re-encrypt traffic to the backend using a custom server certificate. This ensures encryption integrity across both communication segments. Additionally, mutual TLS authentication on the ALB guarantees that both the client and backend servers are authenticated, addressing the strict authentication requirement. TLS passthrough is not supported by an ALB, and using plaintext traffic between the ALB and backend servers would violate encryption requirements.
- A. Correct.
Correct: Configuring the ALB for TLS termination and re-encrypting traffic to the backend with a custom server certificate ensures encryption is maintained across both client-to-ALB and ALB-to-backend communications.
- B. Incorrect.
Incorrect: Enabling TLS passthrough is not supported by an ALB. It requires the use of an NLB. Therefore, this option does not apply to this scenario.
- C. Incorrect.
Incorrect: While an NLB can handle TLS passthrough, it does not support HTTP/HTTPS-specific features like path-based routing, which makes it unsuitable if you need advanced application-layer routing provided by an ALB.
- D. Incorrect.
Incorrect: Using plaintext traffic between the ALB and backend servers violates the requirement for end-to-end encryption.
- E. Correct.
Correct: Mutual TLS authentication on the ALB ensures both the client and backend servers are authenticated, meeting the requirement for strict authentication.