SCS-C02 Question 329
Single answerYour company has an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is used to process sensitive customer data. To comply with security and compliance requirements, your team needs to ensure that all traffic reaching the ALB is encrypted, and any unencrypted requests are rejected. How can you achieve this setup?
- A
Configure the ALB to use an HTTPS listener and redirect HTTP traffic to HTTPS.
- B
Create a Network Load Balancer (NLB) with TLS termination and forward requests to the ALB.
- C
Configure the ALB to only use an HTTPS listener and remove the HTTP listener.
- D
Install SSL/TLS certificates on the EC2 instances and configure the application to enforce HTTPS.
Show answer and explanation
Correct answer: C
Explanation
To ensure that all traffic reaching the ALB is encrypted and unencrypted requests are rejected, you must configure the ALB with an HTTPS listener and remove the HTTP listener. This setup ensures that the ALB only accepts encrypted traffic and meets the security and compliance requirements. Redirection from HTTP to HTTPS does not reject unencrypted traffic outright, and handling SSL/TLS at the EC2 instance level is redundant when using an ALB.
- A. Incorrect.
This option does not reject unencrypted requests outright. While the ALB can redirect HTTP traffic to HTTPS, unencrypted traffic is still initially accepted before redirection, which does not meet the requirement to reject unencrypted requests.
- B. Incorrect.
An NLB does not natively support TLS termination for HTTPS traffic. Additionally, introducing an NLB would unnecessarily complicate the architecture, as the requirement can be handled by the ALB.
- C. Correct.
This option ensures that the ALB only accepts encrypted requests by configuring an HTTPS listener and removing the HTTP listener. This fully meets the requirement to reject unencrypted traffic.
- D. Incorrect.
Installing SSL/TLS certificates on the EC2 instances and enforcing HTTPS at the application level is unnecessary and inefficient when using an ALB. The ALB is designed to handle SSL/TLS termination, and the requirement can be addressed at the ALB level.