SAP-C02 Design for New Solutions Practice Question

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

⚠ Common exam trap

Many candidates confuse network-level controls (security groups, NACLs) with encryption, or assume that using HTTP on the backend is sufficient, forgetting that the client-to-ALB leg must also be encrypted to satisfy 'data in transit' requirements.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.

To encrypt data in transit between clients and the Application Load Balancer (ALB), you must configure the ALB listener to use HTTPS (port 443) with an SSL/TLS certificate. This ensures that all traffic between the client and the load balancer is encrypted using TLS, meeting the requirement for encrypted data in transit for sensitive healthcare data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure the target group to use HTTP protocol.
Why it's wrong here
Target group protocol does not affect client-to-ALB encryption.
✗
Configure the security group to only allow inbound traffic from approved IPs.
Why it's wrong here
Security groups do not encrypt traffic.
✗
Use HTTP on port 80 and rely on VPC network ACLs.
Why it's wrong here
HTTP is unencrypted.
✓
Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.
Why this is correct
HTTPS encrypts traffic between client and ALB.

Go deeper

SAP-C02 Design for New Solutions Practice Question

Why each option matters

Option-by-option breakdown

Related to this question