SOA-C02 Question 215
Select 3Your company has a web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). To ensure secure communication between clients and the application, you are tasked with implementing encryption in transit. Which steps should you take to achieve this?
- A
Use AWS Certificate Manager (ACM) to provision an SSL/TLS certificate and associate it with the Application Load Balancer.
- B
Configure the Application Load Balancer to listen on port 443 and use the SSL/TLS certificate for secure communication.
- C
Install an SSL/TLS certificate directly on each Amazon EC2 instance to encrypt communication at the server level.
- D
Set up a VPN connection between the clients and the Application Load Balancer for secure data transfer.
- E
Enable HTTPS redirection on the Application Load Balancer to ensure all HTTP traffic is automatically redirected to HTTPS.
Show answer and explanation
Correct answers: A, B, E
Explanation
To implement encryption in transit for an application behind an Application Load Balancer (ALB), you need to provision an SSL/TLS certificate (ideally using AWS Certificate Manager) and associate it with the ALB. Configuring the ALB to listen on port 443 ensures that it can handle HTTPS traffic. Additionally, enabling HTTPS redirection ensures all HTTP traffic is securely redirected to HTTPS. Installing SSL/TLS certificates on EC2 instances is redundant in this case, and VPNs are not relevant for securing public web traffic.
- A. Correct.
Correct. AWS Certificate Manager (ACM) simplifies the management of SSL/TLS certificates. Associating the certificate with the ALB ensures that it can handle secure HTTPS traffic.
- B. Correct.
Correct. Configuring the ALB to listen on port 443 with the SSL/TLS certificate is necessary to enable encryption in transit.
- C. Incorrect.
Incorrect. Installing SSL/TLS certificates directly on EC2 instances is unnecessary when using an ALB, as the ALB handles encryption in transit on behalf of the instances.
- D. Incorrect.
Incorrect. VPN connections are used for private, encrypted communication between networks, not for securing public web traffic to an ALB.
- E. Correct.
Correct. Enabling HTTPS redirection ensures that all HTTP traffic is automatically upgraded to HTTPS, improving security.