Encrypt Traffic Between ALB and EC2 with HTTPS Target Groups
A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?
Quick Answer
The answer is to use an HTTPS listener on the ALB and configure the target group with HTTPS. This works because the ALB terminates the client’s TLS connection at the listener and then establishes a separate, encrypted TLS connection to each EC2 instance in the target group, ensuring end-to-end encryption between the load balancer and the backend. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of how Application Load Balancers handle encryption at different layers, often appearing as a distractor where HTTP listeners or TCP listeners are offered as incorrect options. A common trap is assuming that security group rules alone can enforce encryption—they cannot, as they only control access, not data-in-transit protection. Remember the memory tip: “HTTPS all the way” means both the listener and the target group must use HTTPS for full encryption between ALB and EC2.
⚠ Common exam trap
Candidates often assume an HTTPS listener alone encrypts all traffic end-to-end, forgetting that the ALB-to-instance leg must also use HTTPS; otherwise, traffic between the ALB and EC2 instances is in plaintext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an HTTPS listener on the ALB and configure the target group with HTTPS.
It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an HTTPS listener on the ALB and configure the target group with HTTPS.
Why this is correct
HTTPS ensures encryption from ALB to instances.
- ✗
Use a TCP listener on the ALB and a TCP target group.
Why it's wrong here
TCP does not provide encryption.
- ✗
Configure security group inbound rules to allow only HTTPS traffic.
Why it's wrong here
Security groups only filter traffic, they do not enforce encryption.
- ✗
Use an HTTP listener on the ALB and HTTP on the target group.
Why it's wrong here
HTTP does not encrypt traffic between ALB and instances.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?
hard- A.Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.
- B.Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.
- C.Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.
- ✓ D.Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.
Why D: It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.