DOP-C02 Question 386
Single answerYour company hosts a web application on Amazon Elastic Kubernetes Service (EKS) behind an Application Load Balancer (ALB). The application uses HTTPS for secure communication with clients. You are tasked with configuring the ALB to terminate HTTPS connections and ensuring the certificates are automatically renewed before expiration. Which approach should you take to meet these requirements?
- A
Use AWS Certificate Manager (ACM) to provision an SSL/TLS certificate and associate it with the ALB.
- B
Generate an SSL/TLS certificate using OpenSSL and manually upload it to the ALB.
- C
Use a self-signed certificate and configure the ALB to use it for HTTPS traffic.
- D
Configure the ALB to forward HTTPS traffic to the Amazon EKS pods without terminating SSL at the ALB.
Show answer and explanation
Correct answer: A
Explanation
Using AWS Certificate Manager (ACM) to provision and manage the SSL/TLS certificate is the best solution because it integrates seamlessly with the ALB, supports automatic renewal, and ensures secure and reliable HTTPS communication. Other options either involve more manual effort, lack trustworthiness, or do not meet the requirement of terminating HTTPS at the ALB.
- A. Correct.
This is correct. AWS Certificate Manager (ACM) can provision and manage SSL/TLS certificates for your ALB. It also supports automatic certificate renewal, simplifying management.
- B. Incorrect.
This is incorrect because manually uploading a certificate requires ongoing maintenance for renewal and updates, which is not ideal for long-term automation.
- C. Incorrect.
This is incorrect because self-signed certificates are not trusted by clients and can result in security warnings or blocked connections.
- D. Incorrect.
This is incorrect because forwarding HTTPS traffic without terminating SSL at the ALB requires the EKS pods to handle SSL termination, which adds complexity and does not align with the requirement to terminate HTTPS at the ALB.