PAS-C01 Technology Practice Question
A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL Multi-AZ DB instance. The security team requires that all traffic between the ALB and EC2 instances is encrypted, and that the EC2 instances can only be accessed by the ALB. Which TWO steps should be taken to meet these requirements? (Choose TWO.)
⚠ Common exam trap
Many candidates confuse the ALB listener protocol (which encrypts client-to-ALB traffic) with the target group protocol (which encrypts ALB-to-instance traffic), leading them to select Option E instead of Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.
Referencing the ALB's security group in the inbound rule of the EC2 security group ensures that only traffic originating from the ALB is allowed, meeting the requirement that EC2 instances can only be accessed by the ALB. Option D is correct because configuring the target group to use HTTPS protocol ensures that traffic between the ALB and EC2 instances is encrypted using TLS, satisfying the encryption requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In the EC2 security group, allow inbound HTTPS traffic from 0.0.0.0/0.
Why it's wrong here
This would allow any source to access the instances via HTTPS, violating the requirement that only the ALB can access them.
- ✗
Enable encryption at rest on the EC2 instances using EBS encryption.
Why it's wrong here
This encrypts data at rest, not in transit between ALB and EC2.
- ✓
In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.
Why this is correct
This restricts access to only the ALB, meeting the requirement.
- ✓
Configure the target group of the ALB to use HTTPS protocol.
Why this is correct
This ensures traffic from ALB to EC2 instances is encrypted.
- ✗
Configure the ALB with an HTTPS listener and upload the SSL/TLS certificate.
Why it's wrong here
This encrypts client-to-ALB traffic but not necessarily ALB-to-EC2; the target group protocol must also be HTTPS.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.