ANS-C01 Network Security, Compliance and Governance Practice Question

A company uses AWS Certificate Manager (ACM) to provision SSL/TLS certificates for their Application Load Balancer (ALB). They want to ensure that the ALB only accepts connections using TLS 1.2 or higher. How should they configure this?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the ALB with an appropriate security policy that enforces TLS 1.2.

The Application Load Balancer supports security policies that allow you to enforce TLS 1.2 or higher. Option A is incorrect because ACM provides certificates but does not dictate the TLS version; that is determined by the load balancer's security policy. Option C is incorrect because while CloudFront can enforce TLS policies, it is an additional service and not required; the ALB itself can enforce TLS 1.2. Option D is incorrect because Route 53 is a DNS service and does not handle TLS version enforcement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use ACM to generate a certificate that only supports TLS 1.2.
Why it's wrong here
ACM certificates support multiple TLS versions; the certificate itself does not enforce version.
✓
Configure the ALB with an appropriate security policy that enforces TLS 1.2.
Why this is correct
ALB security policies allow specifying minimum TLS protocol version.
✗
Configure the ALB to use a CloudFront distribution with a TLS policy.
Why it's wrong here
CloudFront can enforce TLS versions, but the question is about ALB directly.
✗
Use AWS Route 53 to enforce TLS version at the DNS level.
Why it's wrong here
Route 53 does not inspect TLS versions.

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question