SAA-C03 Practice Question 43: ALB TLS Termination ACM
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 5 · question 3 of 10
A public web application runs on EC2 instances behind an Application Load Balancer. A new standard requires that traffic is encrypted from the viewer all the way to the instances, that the public certificate is renewed automatically, and that the private key is never handled by the operations team.
Which configuration meets these requirements?
Show answer and explanation
Answer:
A standard ACM public certificate is provisioned and renewed by AWS and is not exportable, so its private key is never handled by operations. Attaching it to an HTTPS listener encrypts the viewer-to-ALB segment. Setting the target group's protocol to HTTPS re-encrypts the ALB-to-instance segment, which is what "all the way to the instances" requires; the ALB does not validate the target's certificate, so the instances can present a self-signed one.
Option A leaves the second segment in plaintext, failing the end-to-end requirement, and uploading a certificate to IAM means the team possesses and must rotate the private key.
Option B gives end-to-end encryption but fails the other two requirements. Self-signed certificates on instances are managed by the team, including the private keys, and nothing renews them automatically.
Option D relies on a protection that does not substitute for TLS. AWS encrypts some inter-Region and inter-AZ traffic at the physical layer, but the requirement is for the application traffic to be encrypted to the instance, which an HTTP target group does not do.
Reference: Create an HTTPS listener for your Application Load Balancer