DVA-C02 Security Practice Question
A company wants to encrypt data in transit between an Application Load Balancer and its EC2 instances. The instances run a custom web server. Which configuration should the developer implement?
⚠ Common exam trap
Watch out — candidates often assume setting the ALB listener to HTTPS alone encrypts the entire path, forgetting that the target group protocol must also be HTTPS to encrypt the ALB-to-instance traffic, or they mistakenly think ACM certificates can be directly installed on EC2 instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.
To encrypt data in transit between an Application Load Balancer (ALB) and EC2 instances, the ALB listener must be configured with a TLS certificate for client-to-ALB encryption, and the target group protocol must be set to HTTPS to enable encryption between the ALB and the instances. The EC2 instances must have a server certificate installed (e.g., from ACM or self-signed) to terminate the TLS connection, ensuring end-to-end encryption. This setup allows the ALB to re-encrypt traffic after decrypting it from the client, using HTTPS for the backend connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.
Why this is correct
Configuring the ALB listener with a TLS certificate ensures traffic from the client to the ALB is encrypted. By setting the target group protocol to HTTPS, the ALB then re-encrypts this traffic before forwarding it to the backend EC2 instances. The EC2 instances must have their own server certificates installed and configured on their web servers to successfully complete the TLS handshake, thereby providing comprehensive end-to-end encryption for data in transit.
- ✗
Use AWS Certificate Manager to issue a certificate for the EC2 instances and configure the web server to use it.
Why it's wrong here
While AWS Certificate Manager can issue certificates for EC2 instances, and configuring the web server to use one secures direct connections, this option alone does not guarantee encryption between the ALB and the EC2 instances. The ALB's target group protocol setting dictates how it communicates with its targets. Without explicitly setting the target group protocol to HTTPS, the ALB will forward traffic unencrypted, regardless of whether the EC2 instance has a certificate for direct access.
- ✗
Configure the ALB listener with a TLS certificate and set the target group protocol to HTTP.
Why it's wrong here
Configuring the ALB listener with a TLS certificate successfully encrypts the communication path from the client to the ALB. However, setting the target group protocol to HTTP means the ALB will decrypt the incoming traffic and then transmit it in plain text to the backend EC2 instances. This approach leaves the internal network segment between the ALB and the application servers vulnerable, as data is unencrypted during this critical portion of its journey.
- ✗
Enable client certificate authentication on the ALB.
Why it's wrong here
Enabling client certificate authentication on the ALB implements mutual TLS, where both the client and the server (ALB) authenticate each other using certificates. While this significantly enhances client-side security by verifying client identity, it is a distinct security measure from encrypting the backend traffic. This configuration does not inherently force the ALB to use HTTPS when communicating with its target EC2 instances, which is controlled by the target group protocol setting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.