DOP-C02 Security and Compliance Practice Question
A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.
An ALB can be configured with an HTTPS listener and a redirect rule that sends HTTP traffic to HTTPS, enforcing encrypted transit at the load balancer level. Option A is incorrect because configuring the web server to only respond to HTTPS does not prevent HTTP traffic from reaching the ALB; the ALB would still accept HTTP. Option C is incorrect because security groups filter traffic based on ports and IP addresses but cannot redirect HTTP to HTTPS; they only allow or deny traffic. Option D is incorrect because while CloudFront can redirect HTTP to HTTPS, the question asks for a configuration on the ALB itself, not an additional service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the web server on the EC2 instances to only respond to HTTPS requests.
Why it's wrong here
Configuring the EC2 web server to accept only HTTPS does not stop clients from sending HTTP requests to the ALB. The ALB's HTTP listener still receives those requests; if it is not configured to redirect, the client will get a connection error or a non-standard response rather than being upgraded to HTTPS. It also breaks the ALB's ability to forward traffic over HTTP, and the enforcement is scattered across instances rather than centralized at the load balancer.
- ✓
Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.
Why this is correct
Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS. This is the correct pattern because ALB listeners combine a protocol/port with rule actions: the HTTP (port 80) listener can have a rule that returns a 301/302 redirect to the same path on the HTTPS listener (port 443). This enforces HTTPS at the access point, automatically upgrades clients, and leaves web servers free to handle only HTTP/HTTPS as needed, typically with TLS terminated at the ALB.
- ✗
Configure the security group of the ALB to only allow inbound HTTPS traffic.
Why it's wrong here
Restricting the ALB's security group to allow only inbound 443 is not a redirection mechanism; it is a packet filter. HTTP requests on port 80 would be silently dropped, causing the client browser to time out, not to bounce to HTTPS. Security groups have no rule-action concept like ALB listeners do, so this approach neither enforces HTTPS nor provides a friendly user experience, and the ALB's HTTP listener still exists but is unreachable.
- ✗
Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.
Why it's wrong here
Using CloudFront with a custom SSL certificate and a viewer protocol policy that redirects HTTP to HTTPS is a valid way to enforce encrypted access at the edge, but it is overkill for this scenario. The architecture already includes an ALB, which can perform the same redirect natively without adding a CDN layer, additional DNS/CNAME changes, origin access controls, and cost. The requirement asks for enforcing HTTPS, not for content delivery optimization, so the simpler direct ALB listener approach is preferred.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.