DVA-C02 Security Practice Question
Which THREE components are required to enable encryption in transit for an Application Load Balancer? (Choose THREE.)
⚠ Common exam trap
Watch out — candidates often confuse optional features like SNI or redirect rules as mandatory requirements, when in fact only the security group rule, the certificate, and the listener on port 443 are strictly necessary for encryption in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security group rule allowing inbound traffic on port 443
A security group rule allowing inbound traffic on port 443 is required because the Application Load Balancer (ALB) must accept HTTPS traffic from clients. Without this rule, the ALB's network interface will drop encrypted connections, preventing any TLS handshake from completing. This ensures that traffic between clients and the ALB is encrypted in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A security group rule allowing inbound traffic on port 443
Why this is correct
To enable encryption, the Application Load Balancer (ALB) must be able to receive incoming encrypted traffic from clients. A security group rule allowing inbound traffic on port 443 (HTTPS) is fundamental, as it acts as a virtual firewall, explicitly permitting the necessary TLS communication to reach the ALB. Without this rule, client connections attempting to establish an encrypted session would be blocked at the network layer, preventing any encryption from occurring.
- ✓
An SSL/TLS certificate from ACM or uploaded to IAM
Why this is correct
An SSL/TLS certificate is absolutely essential because it provides the public key necessary for clients to encrypt their symmetric key and verifies the identity of the server (ALB). The ALB uses the corresponding private key, stored securely, to decrypt the client's encrypted symmetric key and establish a secure, encrypted communication channel. Without a valid certificate, the TLS handshake cannot complete, making secure communication impossible.
- ✓
A listener configured on port 443 with the certificate
Why this is correct
A listener configured on port 443 is a mandatory component as it defines the specific port and protocol (HTTPS) on which the Application Load Balancer (ALB) will accept incoming client connections. This listener is where the SSL/TLS certificate is associated, enabling the ALB to perform TLS termination by decrypting incoming encrypted traffic and re-encrypting it if necessary before forwarding to target groups. Without a listener, the ALB has no instruction on how to handle incoming encrypted requests.
- ✗
Server Name Indication (SNI) support
Why it's wrong here
Server Name Indication (SNI) support is not a fundamental requirement for simply enabling encryption on an Application Load Balancer (ALB). SNI is an extension to the TLS protocol that allows a client to specify the hostname it is trying to reach during the TLS handshake, which is crucial only when an ALB needs to host multiple SSL/TLS certificates for different domains on the same IP address. For a single domain requiring encryption, SNI is not necessary.
- ✗
An HTTP to HTTPS redirect rule
Why it's wrong here
An HTTP to HTTPS redirect rule is not a required component for enabling encryption itself. While highly recommended for security best practices to ensure all traffic uses encryption, this rule merely redirects unencrypted HTTP requests to their encrypted HTTPS counterparts. The core encryption mechanism on the Application Load Balancer (ALB) functions independently of whether unencrypted traffic is redirected or simply rejected, meaning encryption can be fully operational without such a redirect.
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.