DOP-C02 Security and Compliance Practice Question
A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. The instances currently use a self-signed certificate for the backend HTTPS listener. The engineer notices that the ALB health checks are failing, and the error message indicates 'TLS handshake failed'. The health check is configured as HTTPS. What should the engineer do to resolve the health check failure while maintaining encryption?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the health check to use HTTP on port 80 and allow HTTP traffic from the ALB to the instances.
The ALB health check fails because the self-signed certificate on the instances is not trusted by the ALB. ACM certificates cannot be installed on EC2 instances, so option A is not feasible. The simplest solution is to change the health check protocol to HTTP (option B), which avoids the TLS handshake entirely. This maintains encryption for the actual application traffic (HTTPS between ALB and instances) while allowing health checks to succeed. Option C is not a valid configuration; there is no 'ignore certificate' option for ALB health checks. Option D is not recommended as health checks provide essential monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a valid certificate from AWS Certificate Manager (ACM) on each EC2 instance and configure the ALB target group to use HTTPS with that certificate.
Why it's wrong here
Wrong. AWS Certificate Manager (ACM) does not provide certificates exportable for installation on EC2 instances. ACM certificates can only be used with integrated AWS services. Thus, this option is not feasible.
- ✓
Change the health check to use HTTP on port 80 and allow HTTP traffic from the ALB to the instances.
Why this is correct
Correct. Changing the health check to HTTP on port 80 eliminates the TLS handshake failure because the ALB will not attempt to establish a secure connection for health checks. The data traffic between ALB and instances can still be encrypted using HTTPS target group settings.
- ✗
Configure the ALB to ignore certificate verification for health checks by setting the health check protocol to HTTPS and enabling 'ignore certificate' option.
Why it's wrong here
Wrong. There is no option in ALB to 'ignore certificate verification' for health checks. The health check protocol can be changed to HTTP as a workaround, but the described option does not exist.
- ✗
Disable health checks on the ALB and rely on CloudWatch alarms to detect instance failures.
Why it's wrong here
Wrong. Disabling health checks removes the ability for the ALB to automatically detect unhealthy instances, which compromises high availability. CloudWatch alarms are not a substitute for health checks.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.