Quick Answer

The answer is to use an AWS Network Load Balancer (NLB) with a TLS listener to terminate and re-encrypt traffic from the ALB to the EC2 instances. This is correct because encrypt in transit for a multi-tier web application requires end-to-end TLS, not just at the edge; the ALB handles HTTPS from clients, but traffic between the ALB and EC2 instances in private subnets is unencrypted by default, so an internal NLB with a TLS listener re-encrypts that hop, while the EC2 instances must also connect to RDS using TLS (e.g., enforcing SSL/TLS for PostgreSQL or MySQL). On the SAA-C03 exam, this tests your understanding of defense in depth and the specific role of NLBs for internal traffic encryption—a common trap is assuming the ALB’s HTTPS listener alone covers all traffic. Remember the memory tip: “ALB at the edge, NLB for the bridge, RDS with TLS for the final ledge.”