SOA-C02 Question 216
Select 2An organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to ensure that all communication between end-users and the application is encrypted in transit. Which combination of steps should the SysOps Administrator take to meet this requirement?
- A
Use AWS Certificate Manager (ACM) to provision an SSL/TLS certificate and associate it with the Application Load Balancer.
- B
Enable TLS termination on the Application Load Balancer and ensure the backend servers communicate over plain HTTP.
- C
Use an OpenVPN connection to secure the communication between the end-users and the Application Load Balancer.
- D
Redirect HTTP traffic to HTTPS using a listener rule on the Application Load Balancer.
- E
Install an SSL/TLS certificate on each EC2 instance and configure the application to use HTTPS.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure encryption in transit for a web application behind an Application Load Balancer, the SysOps Administrator should provision an SSL/TLS certificate using AWS Certificate Manager and associate it with the ALB. This ensures encrypted communication between end-users and the ALB. Additionally, enabling a listener rule to redirect HTTP traffic to HTTPS ensures users are always using a secure connection. Managing SSL/TLS certificates on individual EC2 instances is unnecessary as the ALB handles the SSL/TLS termination.
- A. Correct.
Correct. AWS Certificate Manager (ACM) is used to provision and manage SSL/TLS certificates, and associating the certificate with the ALB ensures encrypted communication between end-users and the ALB.
- B. Incorrect.
Incorrect. While TLS termination on the ALB is a valid option, the backend communication over plain HTTP does not ensure complete encryption in transit.
- C. Incorrect.
Incorrect. OpenVPN is used for creating VPN connections, not for securing communication between end-users and an ALB.
- D. Correct.
Correct. Redirecting HTTP traffic to HTTPS ensures that all communication from end-users is encrypted in transit.
- E. Incorrect.
Incorrect. Installing SSL/TLS certificates on each EC2 instance is unnecessary when using an ALB with ACM as the ALB handles encryption between the end-users and itself.