How to Enforce TLS Encryption Between ALB and EC2
A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)
Quick Answer
The answer is to configure the ALB listener to use HTTPS protocol and configure the target group to use HTTPS protocol. This is correct because encrypting data in transit between ALB and EC2 requires TLS termination at the load balancer and re-encryption on the backend connection; setting the target group to HTTPS ensures that traffic from the ALB to the instances is also encrypted, not just the client-facing side. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of end-to-end encryption versus front-end-only encryption, a common trap where candidates stop at the listener configuration and forget the target group. Remember the memory tip: “Listen for HTTPS, target for HTTPS” — both must be secure to enforce full encryption in transit.
⚠ Common exam trap
Many candidates assume assigning a certificate to the ALB listener alone (Option D) is sufficient for encryption in transit, overlooking that the target group protocol must also be HTTPS to enforce encryption on the backend connection between the ALB and EC2 instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the target group to use HTTPS protocol.
Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the target group to use HTTPS protocol.
Why this is correct
HTTPS target group ensures encryption between ALB and EC2.
- ✗
Enable encryption at rest on the EC2 instances.
Why it's wrong here
Encryption at rest does not affect encryption in transit.
- ✗
Use a network load balancer instead of an ALB.
Why it's wrong here
NLB supports TLS termination but the question specifies ALB.
- ✗
Assign a certificate from ACM to the ALB listener.
Why it's wrong here
While necessary, this alone doesn't enforce encryption in transit. The target group protocol is also needed.
- ✓
Configure the ALB listener to use HTTPS protocol.
Why this is correct
HTTPS listener enables encryption between client and ALB.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to ensure that all data in transit between an Application Load Balancer and EC2 instances is encrypted using TLS. Which configuration is required?
easy- ✓ A.Configure the ALB with an HTTPS listener and the target group with HTTPS protocol.
- B.Configure the ALB with an HTTPS listener and the target group with HTTP protocol.
- C.Configure the ALB with a TLS listener and the target group with TCP protocol.
- D.Configure the ALB with a TCP listener and the target group with HTTP protocol.
Why A: To encrypt data in transit between the Application Load Balancer and EC2 instances, the ALB must have an HTTPS listener and the target group must use HTTPS protocol. This ensures end-to-end TLS encryption from client to ALB and from ALB to EC2 instances. Option A correctly specifies this configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.