SCS-C02 Question 348
Select 3You are setting up a secure website using Amazon CloudFront as a content delivery network and an Application Load Balancer (ALB) for backend servers. You need to ensure that the communication between the client, CloudFront, and the ALB is encrypted using TLS certificates. Which of the following steps are required to implement this setup correctly?
- A
Configure an ACM certificate for the CloudFront distribution and associate it during the CloudFront setup.
- B
Use a self-signed certificate for the ALB to handle TLS termination at the load balancer.
- C
Import a valid SSL/TLS certificate into ACM or IAM for use with the ALB.
- D
Ensure the domain name in the TLS certificate matches the CloudFront distribution's CNAME.
- E
Enable Origin Protocol Policy as 'HTTPS Only' in the CloudFront distribution.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure communication in this scenario, you need a valid TLS certificate for both CloudFront and the ALB. CloudFront requires an ACM certificate for secure client communication, while the ALB requires its own valid certificate. Additionally, setting the Origin Protocol Policy to 'HTTPS Only' ensures that communication between CloudFront and the ALB is encrypted. Self-signed certificates are not suitable for production, and while the TLS certificate must match the domain name for secure communication, it does not specifically need to match the CloudFront CNAME.
- A. Correct.
Correct. CloudFront requires an ACM or other valid TLS certificate for use with HTTPS connections. This ensures secure communication between the client and CloudFront.
- B. Incorrect.
Incorrect. Using a self-signed certificate for the ALB is not recommended for production environments as it does not provide trust to end users. A publicly trusted certificate should be used.
- C. Correct.
Correct. A valid SSL/TLS certificate must be imported into ACM or IAM for the ALB to handle secure communication between CloudFront and the backend servers.
- D. Incorrect.
Incorrect. The domain name in the TLS certificate must match the domain name used by the client to access the service, which is typically associated with the CloudFront distribution, not specifically its CNAME.
- E. Correct.
Correct. Setting the Origin Protocol Policy to 'HTTPS Only' ensures that communication between CloudFront and the ALB is encrypted, maintaining end-to-end security.