A company has a public application. The application uses an Application Load Balancer (ALB) that has a target group of Amazon EC2 instances. The company wants to protect the application from…

AWS WAF cannot be directly associated with a Network Load Balancer (NLB); WAF integrates with Application Load Balancer, CloudFront, or API Gateway, making this option incorrect.

While this option achieves end-to-end encryption and WAF protection, the phrasing of 'public certificate for communication between the ALB and the EC2 instances' is less general than 'third-party certificate'. Typically, for backend traffic within a trusted AWS network, a certificate issued by a private CA or a self-signed one (which could also be a 'third-party certificate') is common.

AWS WAF cannot be directly associated with a Network Load Balancer (NLB), rendering this option invalid for providing web application security.

Configuring the ALB with a public certificate ensures encrypted communication (HTTPS) from clients to the ALB, while AWS WAF on the ALB provides protection against web vulnerabilities. A third-party certificate on the EC2 instances enables HTTPS communication from the ALB to the instances, achieving true end-to-end encryption by re-encrypting traffic for the backend segment.