SCS-C02 Question 332
Single answerA company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has mandated that all communications between clients and the ALB must use TLS 1.2 or higher. How should you configure the ALB to meet this requirement?
- A
Configure the ALB's listener to use the predefined security policy 'ELBSecurityPolicy-TLS-1-2-2017-01'.
- B
Manually upload a self-signed certificate to the ALB and enforce TLS 1.2.
- C
Disable all ciphers in the ALB's security policy except those that support TLS 1.2.
- D
Create a custom security policy in the ALB to allow TLS 1.2 and attach it to the listener.
Show answer and explanation
Correct answer: A
Explanation
To enforce TLS 1.2 or higher on an Application Load Balancer, AWS provides predefined security policies such as 'ELBSecurityPolicy-TLS-1-2-2017-01'. These policies simplify the configuration process and ensure compliance with the required TLS version. Manually uploading certificates, disabling ciphers, or creating custom security policies may introduce errors and are not best practices for this scenario.
- A. Correct.
This is correct. The predefined security policy 'ELBSecurityPolicy-TLS-1-2-2017-01' enforces the use of TLS 1.2 and higher, meeting the security team's requirements.
- B. Incorrect.
This is incorrect. While uploading a self-signed certificate might provide encryption, it does not ensure compliance with TLS 1.2 or higher and is not recommended for production environments.
- C. Incorrect.
This is incorrect. Disabling ciphers manually is error-prone and unnecessary when predefined security policies are available. Predefined policies like 'ELBSecurityPolicy-TLS-1-2-2017-01' already include only the necessary ciphers for TLS 1.2.
- D. Incorrect.
This is incorrect. Creating a custom security policy is complex and unnecessary when AWS provides predefined policies like 'ELBSecurityPolicy-TLS-1-2-2017-01', which meet the requirement.