SAP-C02 Design for New Solutions Practice Question
A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?
⚠ Common exam trap
Candidates often assume health checks must use the same protocol as the target group traffic, but AWS recommends using HTTP health checks even for HTTPS target groups to avoid certificate validation failures and ensure reliable health monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.
It meets all requirements: the ALB terminates SSL/TLS using an ACM certificate on an HTTPS listener, encrypts traffic between ALB and EC2 instances by using HTTPS on the target group with the same ACM certificate (mutual TLS is not required; the ALB re-encrypts using the same certificate), and uses HTTP health checks on port 80 to avoid certificate validation issues during health checks. This ensures end-to-end encryption, high availability across multiple AZs, and minimizes manual intervention by automating certificate management with ACM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.
Why this is correct
This encrypts backend traffic, uses ACM for backend (same cert), and health checks use HTTP to avoid certificate issues.
- ✗
Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTP health checks on port 80.
Why it's wrong here
This does not encrypt traffic between ALB and instances.
- ✗
Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using a self-signed certificate. Configure health checks to use HTTPS on port 443.
Why it's wrong here
Self-signed certificates are not trusted by default and health checks may fail.
- ✗
Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS health checks on port 443 using a separate ACM certificate.
Why it's wrong here
Using a separate ACM certificate for health checks is unnecessary and could cause complexity.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is deploying a web application on AWS. The application runs on EC2 instances behind an ALB. The security team requires that all traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Which THREE steps should the architect take? (Choose three.)
hard- ✓ .Configure the ALB to listen on HTTPS for client connections
- A.Assign the same security group to the ALB and the instances
- B.Place the EC2 instances in a public subnet
- ✓ C.Configure the ALB target group to use HTTPS protocol
- ✓ D.Configure the EC2 instance security group to allow inbound traffic only from the ALB's security group
- E.Use network ACLs to restrict inbound traffic to the ALB's IP addresses
Why : To encrypt traffic between the ALB and EC2 instances and restrict instance access to only the ALB, the architect must take two steps. First, configure the ALB target group to use HTTPS protocol (Option C) to encrypt traffic between the ALB and the backend instances. Second, configure the EC2 instance security group to allow inbound traffic only from the ALB's security group (Option D) to restrict access to only the ALB. The ALB listener HTTPS configuration (the null option) is for client-to-ALB encryption, which is not required by the security team's requirement; it is optional if end-to-end encryption is needed, but the question specifically asks for encryption between ALB and instances. Option A (same security group) would allow all traffic between the group members, not restrictive enough. Option B (public subnet) would expose instances directly to the internet. Option E (network ACLs) cannot reference security groups and is stateless, making it unsuitable.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.