SAP-C02 Design for New Solutions Practice Question
A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The company wants to ensure that traffic to the application is encrypted in transit. Which TWO actions should the company take?
⚠ Common exam trap
It's easy for candidates to think an HTTP-to-HTTPS redirect alone (Option A) is sufficient to encrypt traffic, but the redirect only changes the protocol; the actual encryption requires an HTTPS listener with a certificate installed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install an SSL/TLS certificate on the Application Load Balancer.
Installing an SSL/TLS certificate on the Application Load Balancer (ALB) is required to terminate HTTPS connections and enable encryption of traffic between clients and the ALB. Option E is correct because configuring the ALB with an HTTPS listener is necessary to accept encrypted traffic on port 443 and use the installed certificate for decryption. Together, these actions ensure that traffic to the application is encrypted in transit from the client to the load balancer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the Application Load Balancer with an HTTP listener that redirects to HTTPS.
Why it's wrong here
Redirect is acceptable but the question asks for encryption; HTTP listener itself is not encrypted.
- ✗
Use a Network Load Balancer with TCP listener.
Why it's wrong here
NLB with TCP does not provide encryption; SSL termination is handled at the instance level.
- ✗
Place an Amazon CloudFront distribution in front of the ALB.
Why it's wrong here
CloudFront adds encryption at the edge but does not ensure encryption between ALB and EC2.
- ✓
Install an SSL/TLS certificate on the Application Load Balancer.
Why this is correct
SSL/TLS certificate is required for HTTPS termination.
- ✓
Configure the Application Load Balancer with an HTTPS listener.
Why this is correct
HTTPS listener ensures traffic to the ALB is encrypted.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?
easy- A.Install a self-signed certificate on each EC2 instance
- B.Use a Network Load Balancer (NLB) with SSL pass-through
- ✓ C.Configure the ALB with an SSL certificate
- D.Use Amazon CloudFront for SSL termination
Why C: An Application Load Balancer (ALB) can terminate SSL/TLS by installing a certificate on it, reducing CPU load on backend EC2 instances. Option A (self-signed certificate on each instance) does not offload SSL and is less secure. Option B (NLB with SSL pass-through) does not terminate SSL; it passes encrypted traffic through. Option D (CloudFront) can terminate SSL but is a CDN service, not primarily for SSL offload in this architecture, and adds cost and complexity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.