A web application behind an Application Load Balancer (ALB) currently allows client connections over HTTP (port 80). The security policy requires all client traffic to use HTTPS. What is the best ALB change to enforce this requirement?

Enable TLS only on the target group so that traffic between the ALB and targets is encrypted, even if clients connect via HTTP

Encrypting traffic between the ALB and the targets does not satisfy the requirement, which is about client traffic. If clients still connect to the ALB using HTTP, their traffic is not encrypted in transit from the client to the ALB.

Turn on S3 server-side encryption to ensure data is encrypted in transit from clients to the ALB

S3 server-side encryption protects data at rest in S3. It does not encrypt the client-to-ALB network connection, which is determined by the ALB listener protocol (HTTP vs HTTPS).

Remove port 80 access by removing the port 80 listener and leave only a default target group

Removing the HTTP listener would cause HTTP clients to fail (no redirect or graceful migration path). A redirect to HTTPS both enforces HTTPS and maintains compatibility by guiding clients to the secure endpoint.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Add an HTTP listener on port 80 with a redirect action to HTTPS on port 443, and configure an HTTPS listener using an ACM certificate — Configure the ALB to redirect HTTP (port 80) to HTTPS (port 443) and ensure there is an HTTPS listener using an ACM certificate. This makes clients connect to the ALB over TLS, enforcing encryption in transit for all client requests. Redirects preserve usability for existing HTTP bookmarks and links by automatically sending clients to the HTTPS URL. Why others are wrong: Encrypting only ALB-to-target traffic does not meet the requirement because the client-to-ALB path remains HTTP. S3 encryption does not affect the network transport between clients and the ALB. Simply removing the HTTP listener blocks HTTP clients rather than enforcing a secure transition to HTTPS via redirect.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.