SOA-C02 TLS/SSL Encryption Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure a listener on port 443 with an SSL certificate from AWS Certificate Manager.

  Why this is correct

  An Application Load Balancer (ALB) can terminate TLS by configuring an HTTPS listener on port 443. You must associate a valid SSL/TLS certificate, such as one issued by AWS Certificate Manager (ACM), which the ALB uses to decrypt incoming traffic and establish encrypted sessions with clients. This ensures data in transit is protected against eavesdropping and tampering. ACM integrates natively with ALB, handling certificate renewal automatically.

• ✓

  Use a security group that only allows HTTPS traffic from the client's IP.

  Why this is correct

  A security group functions as a stateful virtual firewall at the ALB level. Allowing inbound traffic only on port 443 (HTTPS) from the client's IP address ensures that any request reaching the load balancer must be TLS-encrypted, as plain HTTP on port 80 is blocked. This effectively restricts the client to using HTTPS only, complementing the listener's TLS termination. However, note that a security group merely filters traffic; it does not itself encrypt anything, which is why it must be paired with a proper HTTPS listener configuration.

• ✗

  Set up an IPsec VPN connection between the client and the ALB.

  Why it's wrong here

  An Application Load Balancer operates at Layer 7 (HTTP/HTTPS) and does not possess any capability to terminate IPsec VPN tunnels. IPsec is a network-layer (Layer 3) protocol used to build secure site-to-site or client-to-site VPNs, typically terminated on AWS customer gateways, VPN endpoints, or EC2 instances with VPN software. An ALB has no such endpoint for IPsec, so it cannot establish an encrypted tunnel with a client. Thus, this is an invalid method for securing client-to-ALB traffic.

• ✗

  Configure a network ACL to allow only port 443.

  Why it's wrong here

  Network ACLs are stateless filters that operate at the subnet boundary, controlling traffic to and from all resources within that subnet. While configuring a NACL to allow only port 443 would restrict the permitted port, it does not introduce encryption; it merely permits packets with destination port 443, regardless of whether the payload is genuinely TLS or plaintext sent to port 443. Also, because NACLs are stateless, you must separately configure outbound rules for return traffic, and they cannot distinguish valid HTTPS sessions from other traffic. Therefore, this measure alone does not secure communication between a client and the ALB.

• ✗

  Enable the ALB's built-in SSL/TLS encryption without a certificate.

  Why it's wrong here

  SSL/TLS encryption is fundamentally dependent on a cryptographic certificate to establish trust and negotiate session keys. An ALB has no 'built-in' encryption that can operate without a certificate; the HTTPS listener specifically requires a certificate to be configured. The certificate is used to prove the server's identity and to encrypt the TLS handshake. Without a valid certificate, the ALB cannot perform TLS termination, so this option is not a valid method.

Go deeper

Related to this question