SOA-C03 · Question #164
A company runs a retail website on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The company must secure traffic to the website over an HTTPS connection. Which combination…
The correct answer is B. Attach the certificate to the ALB. D. Create a public certificate in AWS Certificate Manager (ACM). To enable HTTPS on a public retail website behind an ALB, a public SSL/TLS certificate must be provisioned in ACM and attached directly to the ALB listener, which handles SSL termination for all backend EC2 instances.
Question
A company runs a retail website on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The company must secure traffic to the website over an HTTPS connection. Which combination of actions should a SysOps administrator take to meet these requirements? (Choose two.)
Options
- AAttach the certificate to each EC2 instance.
- BAttach the certificate to the ALB.
- CCreate a private certificate in AWS Certificate Manager (ACM).
- DCreate a public certificate in AWS Certificate Manager (ACM).
- EExport the certificate, and attach it to the website.
How the community answered
(46 responses)- A9% (4)
- B85% (39)
- C4% (2)
- E2% (1)
Why each option
To enable HTTPS on a public retail website behind an ALB, a public SSL/TLS certificate must be provisioned in ACM and attached directly to the ALB listener, which handles SSL termination for all backend EC2 instances.
Attaching a certificate to each individual EC2 instance is operationally burdensome and unnecessary when an ALB handles SSL termination centrally; the ALB, not the instances, terminates the HTTPS connection from clients.
The ALB acts as the SSL/TLS termination point for incoming HTTPS traffic; attaching the certificate to the ALB listener (port 443) allows it to decrypt traffic and forward requests to EC2 instances, centralizing certificate management without requiring per-instance configuration.
A private certificate issued by ACM Private CA is intended for internal resources within a private network and is not trusted by public browsers, making it unsuitable for a public-facing retail website.
A public certificate from ACM is required for a publicly accessible retail website because it is trusted by browsers and clients by default; ACM provides free public certificates that are automatically renewed and can be directly deployed to ALB without exporting.
ACM public certificates cannot be exported; they are designed to be used directly with integrated AWS services like ALB, and exporting is only supported for certificates imported into ACM or issued by ACM Private CA.
Concept tested: HTTPS termination using ACM certificates on ALB
Source: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
Topics
Community Discussion
No community discussion yet for this question.