A company has an application that hosts personally identifiable information (PII) of users. All connections to the application must be secured by HTTPS with TLS certificates that implement Elliptic…

Question

Options

• AProvision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC
• BProvision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an
• CProvision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC
• DProvision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an

• A
  15% (4)
• B
  4% (1)
• C
  74% (20)
• D
  7% (2)

Explanation

Explanation

Option C is correct because a Network Load Balancer (NLB) with a TLS listener supports ECC certificates, offloads TLS termination at the load balancer, and - critically - maintains session stickiness (stateful connections) through its flow-based routing, which preserves the TCP connection between clients and the same backend instance. Option A is incorrect because, while it also uses an NLB with a TLS listener, it likely specifies an RSA-based security policy rather than one that enforces ECC - failing the ECC certificate requirement. Options B and D use an Application Load Balancer (ALB), which operates at Layer 7 and does support HTTPS listeners, but ALBs terminate connections and re-establish new ones to the backend, making true stateful connection persistence more complex and less reliable for stateful workloads compared to the NLB's Layer 4 flow-based approach.

Memory Tip: Think "NLB = Network = stateful flows stay sticky." When you see stateful connections + TLS offload + ECC, pair NLB with a TLS listener using an ECC-compatible security policy (e.g., ELBSecurityPolicy-TLS13-1-2-2021-06). ALBs are great for content-based routing, but NLBs win when raw TCP session stickiness matters.

No community discussion yet for this question.