SCS-C02 · Question #381
A company is operating a website using Amazon CloudFornt. CloudFront servers some content from Amazon S3 and other from web servers running EC2 instances behind an Application. Load Balancer (ALB). Am
The correct answer is C. Update the CloudFront distribution to redirect HTTP corrections to HTTPS E. Update the ALB listen to listen using HTTPS using the public ACM TLS certificate. F. Create a TLS certificate Configure the web servers on the EC2 instances to use HTTPS only with. C, E, F together secure every hop in the request chain: C enforces HTTPS between end users and CloudFront (viewer protocol), E secures the CloudFront-to-ALB connection using an ACM public certificate on the ALB listener, and F secures the final ALB-to-EC2 leg by installing a TLS
Question
A company is operating a website using Amazon CloudFornt. CloudFront servers some content from Amazon S3 and other from web servers running EC2 instances behind an Application. Load Balancer (ALB). Amazon DynamoDB is used as the data store. The company already uses AWS Certificate Manager (ACM) to store a public TLS certificate that can optionally secure connections between the website users and CloudFront. The company has a new requirement to enforce end- to-end encryption in transit. Which combination of steps should the company take to meet this requirement? (Choose three.)
Options
- AUpdate the CloudFront distribution. configuring it to optionally use HTTPS when connecting to
- BUpdate the web application configuration on the web servers to use HTTPS instead of HTTP
- CUpdate the CloudFront distribution to redirect HTTP corrections to HTTPS
- DConfigure the web servers on the EC2 instances to listen using HTTPS using the public ACM TLS
- EUpdate the ALB listen to listen using HTTPS using the public ACM TLS certificate.
- FCreate a TLS certificate Configure the web servers on the EC2 instances to use HTTPS only with
How the community answered
(14 responses)- A7% (1)
- B14% (2)
- C79% (11)
Explanation
C, E, F together secure every hop in the request chain: C enforces HTTPS between end users and CloudFront (viewer protocol), E secures the CloudFront-to-ALB connection using an ACM public certificate on the ALB listener, and F secures the final ALB-to-EC2 leg by installing a TLS certificate directly on the web servers - completing true end-to-end encryption.
Why the distractors are wrong:
- A is wrong because "optionally" allows HTTP, which fails to enforce encryption.
- B is wrong because changing application-level HTTP calls doesn't configure the server's listener to accept/require HTTPS connections.
- D is wrong because ACM public certificates cannot be exported or installed on EC2 instances - they only work with AWS-managed services like ALB, CloudFront, and API Gateway. F is correct because it specifies creating a separate TLS certificate (e.g., self-signed or from a private CA) that can actually be installed on EC2.
Memory tip: Picture three network hops and remember "ACM stays in AWS-land." Secure hop 1 (user→CF) with a redirect (C), hop 2 (CF→ALB) with ACM on the ALB (E), and hop 3 (ALB→EC2) with a custom cert on the instance (F) - because ACM public certs never touch EC2 directly.
Topics
Community Discussion
No community discussion yet for this question.