Question
An ecommerce company is hosting a web application on Amazon EC2 instances to handle continuously changing customer demand. The EC2 instances are part of an Auto Scaling group. The company wants to implement a solution to distribute traffic from customers to the EC2 instances. The company must encrypt all traffic at all stages between the customers and the application servers. No decryption at intermediate points is allowed.
Which solution will meet these requirements?
- A. Create an Application Load Balancer (ALB). Add an HTTPS listener to the ALB. Configure the Auto Scaling group to register instances with the ALB's target group.
- B. Create an Amazon CloudFront distribution. Configure the distribution with a custom SSL/TLS certificate. Set the Auto Scaling group as the distribution's origin.
- C. Create a Network Load Balancer (NLB). Add a TCP listener to the NLB. Configure the Auto Scaling group to register instances with the NLB's target group. Correct
- D. Create a Gateway Load Balancer (GLB). Configure the Auto Scaling group to register instances with the GLB's target group.
Explanation
The correct answer is C. A Network Load Balancer with a TCP listener on port 443 works at layer 4 and passes the encrypted TLS stream straight through to the EC2 instances, so traffic is decrypted only on the application servers and the requirement of no decryption at intermediate points is met. The Auto Scaling group registers instances with the NLB target group as demand changes. An ALB HTTPS listener (A) and a CloudFront distribution (B) both terminate TLS, so traffic is decrypted at the load balancer or edge location even if it is re-encrypted to the origin. A Gateway Load Balancer (D) is for inserting third-party virtual appliances such as firewalls, not for distributing customer traffic to application servers.
