SCS-C02 Question 474
Select 4An organization is deploying a new web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team has mandated that all incoming traffic to the application must be encrypted end-to-end. Which of the following steps should be taken to ensure compliance with this requirement?
- A
Configure HTTPS listeners on the Application Load Balancer.
- B
Install SSL/TLS certificates on the Application Load Balancer.
- C
Configure the EC2 instances to accept traffic on HTTP port 80.
- D
Install SSL/TLS certificates on the EC2 instances.
- E
Configure the EC2 instances to accept traffic on HTTPS port 443.
- F
Use a Network Load Balancer instead of an Application Load Balancer.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To ensure end-to-end encryption, traffic must be encrypted from the client to the ALB and from the ALB to the EC2 instances. This requires enabling HTTPS listeners and installing SSL/TLS certificates on the ALB. Additionally, SSL/TLS certificates must also be installed on the EC2 instances, and the instances must be configured to accept HTTPS traffic on port 443. Configuring traffic over HTTP or using a Network Load Balancer is not necessary for this use case.
- A. Correct.
Correct. To enable end-to-end encryption, the ALB must use HTTPS listeners to handle encrypted traffic.
- B. Correct.
Correct. SSL/TLS certificates are required on the ALB for it to terminate HTTPS connections from the client.
- C. Incorrect.
Incorrect. Configuring EC2 instances to accept traffic on HTTP port 80 would violate the requirement for end-to-end encryption.
- D. Correct.
Correct. SSL/TLS certificates must be installed on the EC2 instances to ensure traffic remains encrypted between the ALB and the EC2 instances.
- E. Correct.
Correct. EC2 instances must be configured to accept encrypted traffic over HTTPS port 443 to maintain end-to-end encryption.
- F. Incorrect.
Incorrect. While a Network Load Balancer can be used for TCP traffic, it is not a requirement, and an ALB can handle HTTPS traffic with end-to-end encryption when configured correctly.