SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable encryption at rest on the EC2 instance's EBS volumes.

  Why it's wrong here

  Enabling EBS encryption on the EC2 instance's volumes protects data at the storage layer, but it does absolutely nothing for data moving across the network. Encryption in transit between the client, ALB, and EC2 instance is handled by TLS/HTTPS, not by block-level volume encryption. Therefore, this measure cannot satisfy the requirement to encrypt traffic in transit.

• ✓

  Ensure the EC2 instance has a valid SSL/TLS certificate installed.

  Why this is correct

  If the Application Load Balancer is configured to forward traffic to the target group using HTTPS, the EC2 instance must have a valid SSL/TLS certificate installed to complete the TLS handshake. The instance presents this certificate to the ALB so that the session between them is encrypted, ensuring end-to-end protection from the client to the backend. Without a trusted, valid certificate matching the target's hostname, the ALB cannot establish the encrypted connection.

• ✗

  Configure the security group to allow only encrypted traffic.

  Why it's wrong here

  Security groups act as a stateful virtual firewall, controlling traffic based on source IP, destination IP, protocol, and port; they have no ability to inspect payload content or determine whether traffic is encrypted. Configuring a rule that 'allows only encrypted traffic' is impossible because security groups cannot read TLS metadata or require encryption. Encryption must be implemented at a higher layer, such as HTTPS/TLS, not through a security group rule.

• ✓

  Configure the ALB listener to use HTTPS protocol.

  Why this is correct

  Setting the ALB listener to the HTTPS protocol on port 443 causes the load balancer to negotiate TLS and encrypt all data transmitted from clients to the ALB. This step is essential for protecting traffic at the internet-facing edge, and it is the first half of an encrypted transit path. However, it alone does not ensure encryption beyond the ALB unless the target group or instance is also configured for HTTPS.

• ✓

  Install an SSL/TLS certificate on the Application Load Balancer.

  Why this is correct

  An HTTPS listener on an Application Load Balancer requires a valid SSL/TLS certificate to be installed on the ALB so it can present to clients during the handshake. The certificate, typically stored in AWS Certificate Manager, must cover the exact DNS name clients use to reach the application and be unexpired. Without it, clients would get certificate errors and the encrypted listener cannot be used.

Go deeper

Related to this question