SAP-C02 Design for New Solutions Practice Question
A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB with an SSL certificate
An Application Load Balancer (ALB) can terminate SSL/TLS by installing a certificate on it, reducing CPU load on backend EC2 instances. Option A (self-signed certificate on each instance) does not offload SSL and is less secure. Option B (NLB with SSL pass-through) does not terminate SSL; it passes encrypted traffic through. Option D (CloudFront) can terminate SSL but is a CDN service, not primarily for SSL offload in this architecture, and adds cost and complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a self-signed certificate on each EC2 instance
Why it's wrong here
Installing a self-signed certificate on each EC2 instance does not offload SSL/TLS termination; the instances still handle decryption, and self-signed certificates are not trusted by default.
- ✗
Use a Network Load Balancer (NLB) with SSL pass-through
Why it's wrong here
Network Load Balancer (NLB) with SSL pass-through does not terminate SSL; it forwards encrypted traffic to the instances, so CPU usage is not reduced.
- ✓
Configure the ALB with an SSL certificate
Why this is correct
Configuring the ALB with an SSL certificate offloads SSL/TLS termination to the load balancer, reducing CPU usage on the instances. This is the recommended approach.
- ✗
Use Amazon CloudFront for SSL termination
Why it's wrong here
Amazon CloudFront can terminate SSL, but it is a content delivery network (CDN). Using it solely for SSL offload when an ALB is already in place adds unnecessary complexity and cost.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.