SOA-C02 Question 213
Select 3Your company has a web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). To meet compliance requirements, you must encrypt all traffic between clients and the ALB, as well as between the ALB and the backend EC2 instances. Which of the following steps should you take to achieve this?
- A
Use AWS Certificate Manager (ACM) to provision an SSL/TLS certificate and attach it to the Application Load Balancer.
- B
Enable HTTPS listeners on the Application Load Balancer and configure the listener rules to use the ACM certificate.
- C
Install an SSL/TLS certificate on each backend EC2 instance and configure the ALB to forward traffic using TCP.
- D
Configure the ALB's target group to use HTTPS as the protocol for communication with backend instances.
- E
Use a VPN connection to encrypt traffic between the ALB and backend EC2 instances.
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement end-to-end encryption, you must encrypt traffic between clients and the ALB, as well as between the ALB and backend EC2 instances. Using AWS Certificate Manager (ACM) to provision SSL/TLS certificates, enabling HTTPS listeners on the ALB, and configuring the ALB's target group to use HTTPS are the appropriate steps. Installing certificates on EC2 instances or using a VPN is not required in this setup.
- A. Correct.
Correct: AWS Certificate Manager (ACM) can be used to provision SSL/TLS certificates, which are required for encrypting traffic between clients and the ALB.
- B. Correct.
Correct: Enabling HTTPS listeners and attaching the ACM certificate ensures encrypted communication between the clients and the ALB.
- C. Incorrect.
Incorrect: Installing SSL/TLS certificates on each EC2 instance is unnecessary in this scenario because the ALB can handle SSL termination. Also, TCP does not encrypt traffic.
- D. Correct.
Correct: Configuring the ALB's target group to use HTTPS ensures that traffic between the ALB and backend instances is encrypted.
- E. Incorrect.
Incorrect: A VPN connection is not needed or relevant for encrypting traffic between the ALB and backend EC2 instances in this scenario.