SAA-C03 Question 35
Select 3A company is designing a new web application that stores sensitive customer data. The application will be hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). To ensure data security, the company wants to encrypt all traffic between the client and the application, as well as between the ALB and the EC2 instances. What should the company do to meet this requirement?
- A
Configure the ALB to use an HTTPS listener with a valid SSL/TLS certificate for client-to-ALB communication.
- B
Use an HTTP listener on the ALB and configure the EC2 instances to handle SSL/TLS termination.
- C
Install SSL/TLS certificates on the EC2 instances and configure them to use HTTPS for ALB-to-EC2 communication.
- D
Enable server-side encryption (SSE) for the EC2 instances to secure traffic.
- E
Use AWS Certificate Manager (ACM) to provision and manage SSL/TLS certificates for the ALB.
Show answer and explanation
Correct answers: A, C, E
Explanation
To design a secure workload, the company must ensure that traffic is encrypted both between the client and the ALB and between the ALB and the EC2 instances. An HTTPS listener with a valid SSL/TLS certificate on the ALB secures client-to-ALB communication. Installing SSL/TLS certificates on the EC2 instances ensures ALB-to-EC2 encryption. Using AWS Certificate Manager (ACM) simplifies certificate management for the ALB.
- A. Correct.
Correct: Configuring the ALB with an HTTPS listener and a valid SSL/TLS certificate ensures that all traffic between the client and the ALB is encrypted.
- B. Incorrect.
Incorrect: Using an HTTP listener does not encrypt traffic between the client and the ALB, which violates the security requirement.
- C. Correct.
Correct: Installing SSL/TLS certificates on the EC2 instances ensures that traffic between the ALB and the EC2 instances is encrypted.
- D. Incorrect.
Incorrect: Server-side encryption (SSE) is used for encrypting data at rest, not for securing traffic between components.
- E. Correct.
Correct: AWS Certificate Manager (ACM) simplifies the provisioning and management of SSL/TLS certificates for the ALB.