An internal web application must require encrypted client connections. The company currently has an ALB listener on port 80 (HTTP), and users can access the application over plain HTTP. What is the best change to ensure all client traffic uses HTTPS?

Enable S3 default encryption so HTTP requests are automatically encrypted in transit.

S3 default encryption protects data at rest in S3. It does not encrypt network traffic between clients and the ALB, which remains plaintext if users connect to the HTTP listener.

Set the application to encrypt data only after it is received by the ALB.

Encrypting only after the request arrives at the ALB does not protect the hop between the client and the ALB. Plain HTTP would still be used on that leg, violating the requirement for encrypted client connections.

Rely on WAF alone to encrypt HTTP traffic.

AWS WAF is a web application firewall that inspects and filters HTTP requests. It does not provide TLS termination or encryption for client connections; TLS must be configured via HTTPS listeners (for example, on the ALB).

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Configure an HTTPS (port 443) listener using an ACM certificate and update the port 80 listener to redirect to HTTPS (or to block plain HTTP requests). — To ensure encryption in transit, configure the ALB with an HTTPS listener (port 443) backed by an ACM certificate so the ALB terminates TLS for client connections. Then ensure the port 80 listener does not allow successful HTTP sessions—typically by redirecting HTTP to HTTPS or returning a blocked response for HTTP requests. This directly enforces TLS for the client-to-ALB hop. Encrypting data at rest (for example, using S3/KMS) does not secure the network path between the client and the ALB, and application-layer encryption after arrival is too late to satisfy transport encryption requirements for that hop. S3/KMS encryption addresses storage encryption, not transport security. Encrypting data in the application after the client request reaches the ALB does not prevent the client-to-ALB leg from being plaintext HTTP. WAF can filter requests but does not implement TLS encryption, so it cannot replace configuring HTTPS on the ALB.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.