ANS-C01 · Question #1
A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the…
The correct answer is A. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, configure a. ALB does support HTTP/2 and gRPC workloads. However, the title mentions that the company needs to use mutual TLS for mutual authentication between the client and the backend. This means that traffic cannot be decrypted between the client and the service backend. Since the ALB…
Question
A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend. Which solution will meet these requirements?
Options
- AInstall the AWS Load Balancer Controller for Kubernetes. Using that controller, configure a
- BInstall the AWS Load Balancer Controller for Kubernetes. Using that controller, configure an
- CCreate a target group. Add the EKS managed node group's Auto Scaling group as a target Create
- DCreate a target group. Add the EKS managed node group's Auto Scaling group as a target.
How the community answered
(31 responses)- A61% (19)
- B6% (2)
- C23% (7)
- D10% (3)
Explanation
ALB does support HTTP/2 and gRPC workloads. However, the title mentions that the company needs to use mutual TLS for mutual authentication between the client and the backend. This means that traffic cannot be decrypted between the client and the service backend. Since the ALB will terminate the TLS connection and decrypt the traffic, it does not meet the requirements In contrast, NLB can forward TCP traffic without decrypting the traffic, so it is more suitable for meeting the needs described in the title. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-mutual-tls- authentication-for-applications-running-on-amazon-eks.html
Topics
Community Discussion
No community discussion yet for this question.