Quick Answer

The correct answer includes using a security group on the ECS tasks that allows inbound traffic only from the ALB's security group. This works because deploying ECS Fargate tasks in private subnets behind an internal ALB ensures that all traffic between the ALB and tasks stays within the AWS network, never traversing the public internet, while enabling encryption at rest on ElastiCache for Redis with a customer-managed KMS key secures the session data as mandated. On the SAA-C03 exam, this scenario tests your understanding of combining network isolation with data protection—a common trap is to choose public subnets or forget that encryption at rest requires explicitly enabling it on the ElastiCache cluster, not just using a transit gateway. A useful memory tip is “private ALB, private subnet, security group lock,” which reminds you that internal load balancers paired with security group referencing and encrypted ElastiCache cover both traffic and data security requirements.