SCS-C02 Infrastructure Security Practice Question
A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?
⚠ Common exam trap
Candidates often confuse 'encryption in transit' with 'network access control' (security groups) or assume that any load balancer with TLS listeners guarantees encryption between the load balancer and targets, but only an ALB with HTTPS target groups re-encrypts traffic to the instances, while an NLB with TLS passthrough does not re-encrypt.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.
It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.
Why it's wrong here
The ALB would not terminate HTTPS; encryption is end-to-end but requires instance certificates.
- ✓
Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.
Why this is correct
This ensures traffic between ALB and instances is encrypted.
- ✗
Use a Network Load Balancer with TLS listeners and target groups.
Why it's wrong here
NLB supports TLS but requires certificates on targets for end-to-end encryption.
- ✗
Configure security groups to allow only HTTPS traffic.
Why it's wrong here
Security groups filter traffic but do not encrypt it.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to ensure that all data in transit between an Application Load Balancer (ALB) and EC2 instances is encrypted. What configuration is required?
hard- A.Configure the security group to allow traffic on port 443.
- B.Configure the ALB listener with HTTPS protocol.
- C.Configure the ALB to terminate TLS connections.
- ✓ D.Configure the target group to use HTTPS protocol.
Why D: To encrypt traffic between ALB and EC2, the target group must use HTTPS protocol. Option D is correct. Option A (security group) controls access, not encryption. Option B (listener protocol) is for client-to-ALB encryption. Option C (TLS termination) is for the listener, not backend.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.