SCS-C02 Question 263
Select 2An organization is hosting a web application in AWS that processes sensitive customer data. The application is running on Amazon EC2 instances behind an Application Load Balancer (ALB). To enhance security, the organization wants to ensure that only encrypted traffic is allowed between clients and the ALB, and also between the ALB and the EC2 instances. Which of the following steps should be taken to meet this requirement?
- A
Configure an HTTPS listener on the ALB and upload a valid SSL/TLS certificate for the domain.
- B
Enable Server Name Indication (SNI) on the ALB to support multiple SSL/TLS certificates.
- C
Install an SSL/TLS certificate on the EC2 instances and configure the ALB to forward traffic using HTTPS.
- D
Configure a security group to allow only TCP port 443 between ALB and EC2 instances.
- E
Use AWS Certificate Manager (ACM) to automatically rotate the SSL/TLS certificates on the EC2 instances.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure end-to-end encryption, HTTPS must be configured both between clients and the ALB (using an HTTPS listener and a valid SSL/TLS certificate) and between the ALB and the EC2 instances (by installing SSL/TLS certificates on the EC2 instances). Configuring a security group or enabling SNI are complementary steps but do not directly achieve the goal of encryption. ACM cannot manage certificates on EC2 instances, so it is not relevant here.
- A. Correct.
Correct: Configuring an HTTPS listener on the ALB and uploading a valid SSL/TLS certificate ensures encrypted communication between clients and the ALB.
- B. Incorrect.
Incorrect: Enabling SNI is not necessary in this case unless the ALB needs to handle multiple SSL/TLS certificates for different domains. It is not explicitly required to achieve the stated goal.
- C. Correct.
Correct: Installing an SSL/TLS certificate on the EC2 instances ensures encrypted communication between the ALB and the EC2 instances.
- D. Incorrect.
Incorrect: Configuring a security group to allow only TCP port 443 is a good practice, but it does not enforce encryption. Security groups control access but do not encrypt traffic.
- E. Incorrect.
Incorrect: AWS Certificate Manager (ACM) cannot directly manage certificates installed on EC2 instances. Certificates on EC2 instances must be managed manually or via scripts.