ANS-C01 Question 97
Select 2You are designing a secure web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires end-to-end encryption, and the client connections need to be authenticated using SSL/TLS certificates. Which of the following configurations should you implement to meet these requirements?
- A
Enable TLS termination at the Application Load Balancer and use an SSL certificate issued by AWS Certificate Manager (ACM).
- B
Configure TLS passthrough at the Application Load Balancer and manage SSL/TLS certificates on the backend EC2 instances.
- C
Use an Application Load Balancer with a custom Secure Listener and enable Server Name Indication (SNI).
- D
Encrypt traffic between the Application Load Balancer and backend EC2 instances using a self-signed certificate.
- E
Enable client authentication by attaching a trusted CA certificate to the Application Load Balancer.
Show answer and explanation
Correct answers: B, E
Explanation
To achieve end-to-end encryption, you need to use TLS passthrough so that the encrypted traffic is forwarded from the ALB to the backend EC2 instances without decryption. Additionally, enabling client authentication by attaching a trusted CA certificate to the ALB ensures that client connections are securely authenticated. These configurations together satisfy the requirements for both encryption and authentication.
- A. Incorrect.
This option enables TLS termination at the ALB, which terminates the secure connection at the load balancer. This would not meet the requirement for end-to-end encryption since traffic between the ALB and backend EC2 instances would not be encrypted.
- B. Correct.
TLS passthrough allows the ALB to forward encrypted traffic directly to the EC2 instances, ensuring end-to-end encryption. The SSL/TLS certificates are managed on the EC2 instances for authentication.
- C. Incorrect.
While using an ALB with a custom Secure Listener and enabling SNI can handle multiple SSL/TLS certificates, it does not inherently address end-to-end encryption or client authentication.
- D. Incorrect.
Using self-signed certificates can encrypt traffic between the ALB and EC2 instances, but it does not provide a trusted authentication mechanism for client connections, making it less secure.
- E. Correct.
Attaching a trusted CA certificate to the ALB enables client authentication, which satisfies the requirement for verifying the client connections.