ANS-C01 Question 96
Single answerYou are designing an application that requires secure communication between clients and your backend servers. You are using an Application Load Balancer (ALB) in AWS to distribute traffic across multiple EC2 instances. The application must meet strict compliance requirements, ensuring that end-to-end encryption is maintained. Which configuration should you implement to achieve this?
- A
Enable TLS termination at the ALB and use HTTP to communicate with the backend instances.
- B
Enable TLS passthrough on a Network Load Balancer (NLB) and configure the backend instances to handle TLS decryption.
- C
Enable TLS termination at the ALB and re-encrypt traffic from the ALB to the backend instances using HTTPS.
- D
Disable TLS on the ALB and use HTTP to communicate with both clients and backend instances.
Show answer and explanation
Correct answer: C
Explanation
To meet compliance requirements for end-to-end encryption, TLS must be used to secure traffic between the client, the load balancer, and the backend instances. Configuring TLS termination at the ALB and re-encrypting traffic to the backend instances ensures secure communication while maintaining compliance. The other options either disable encryption or fail to use the specified Application Load Balancer (ALB).
- A. Incorrect.
This option does not provide end-to-end encryption because the traffic between the ALB and backend instances is unencrypted. This violates the compliance requirements.
- B. Incorrect.
While TLS passthrough maintains end-to-end encryption, this option uses a Network Load Balancer (NLB) instead of an Application Load Balancer (ALB). The scenario specifies the use of an ALB, so this option is not valid.
- C. Correct.
This option ensures that TLS is terminated at the ALB for client communication and that traffic is re-encrypted when forwarded to the backend instances, providing end-to-end encryption and meeting compliance requirements.
- D. Incorrect.
Disabling TLS entirely results in no encryption, which violates the compliance requirements for secure communication.