ANS-C01 Question 98
Select 3You are designing an application hosted on AWS that requires secure communication between clients and backend servers. You are using an Application Load Balancer (ALB) to distribute incoming traffic to the backend EC2 instances. To ensure encryption and authentication, which of the following considerations should you take into account while configuring the load balancer?
- A
Enable TLS termination at the ALB and ensure the ALB is configured with a valid SSL/TLS certificate.
- B
Use TLS passthrough at the ALB to forward encrypted traffic directly to the backend instances without decryption.
- C
Ensure that backend instances are configured to handle unencrypted traffic if TLS termination is enabled at the ALB.
- D
Use AWS Certificate Manager (ACM) to manage and attach SSL/TLS certificates to the ALB.
- E
Configure mutual TLS authentication on the ALB to authenticate both the client and the server.
Show answer and explanation
Correct answers: A, C, D
Explanation
In this scenario, using an Application Load Balancer, TLS termination is the appropriate choice to handle secure connections. The ALB must be configured with a valid SSL/TLS certificate, which can be managed using AWS Certificate Manager (ACM). Once TLS termination is enabled, the ALB decrypts incoming traffic and forwards it to the backend instances as unencrypted traffic, requiring the backend to be configured accordingly. Mutual TLS authentication and TLS passthrough are not supported by ALBs, making them incorrect choices in this context.
- A. Correct.
Correct. Enabling TLS termination at the ALB and attaching a valid SSL/TLS certificate ensures that the ALB decrypts incoming traffic securely before forwarding it to the backend.
- B. Incorrect.
Incorrect. TLS passthrough is not supported by Application Load Balancers. ALBs are designed to terminate TLS and inspect the traffic before forwarding it to backend instances.
- C. Correct.
Correct. When TLS termination is enabled at the ALB, the backend instances receive unencrypted traffic. It is essential to configure the backend instances to handle this correctly.
- D. Correct.
Correct. AWS Certificate Manager (ACM) simplifies the management and attachment of SSL/TLS certificates to the ALB, ensuring secure connections.
- E. Incorrect.
Incorrect. Application Load Balancers do not natively support mutual TLS authentication. This feature is supported by Network Load Balancers (NLBs) using TLS listeners.