Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 1 discussion

Option B is incorrect because an Application Load Balancer (ALB) does not support TLS passthrough and decrypts the traffic before forwarding it to the backend servers. Option C is incorrect because an Application Load Balancer (ALB) does not support mutual TLS authentication (mTLS), which is required for this use case. Option D is incorrect because a TLS listener is not suitable for this use case. TLS passthrough is required, and the correct listener type for NLB is TCP.

ALB does not support mutual TLS and will decrypt the traffic https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

100% B correct " Option B (ALB with HTTPS): ALB operates at Layer 7 and terminates TLS connections, which would decrypt traffic at the load balancer, violating the requirement that traffic must remain encrypted between the client and backend. https://shorturl.at/BhwEB

Option B (ALB with HTTPS): ALB operates at Layer 7 and terminates TLS connections, which would decrypt traffic at the load balancer, violating the requirement that traffic must remain encrypted between the client and backend.

As of 21 march 2024 Mtls is supported with alb

100% A correct "

I TINK A

FYI. There are many new questions in the exam taken in June.

gRPC is not supported by NLB natively til now (2024/6)

AAAAAAA

consider of 3 points 1. gRPC protocol 2. thousands of connections 3. Mutula TLS above 3 points supports ALB not NLB. hence answer would be B

Correct answer is B. ALB support gRPC, not NLB. AWS Load Balancer Controller manage ALB for K8s cluster. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/deploy-a-grpc-based-application-on-an-amazon-eks-cluster-and-access-it-with-an-application-load-balancer.html

Using an Application Load Balancer (ALB) with an HTTPS listener on port 443 ensures encryption of traffic in transit.

now both A and B are correct before MTLS was only supported by NLB but last reinvent mtls is now supported on ALB also

I asked the 'Amazon Q'. And it said B is correct...

The AWS Load Balancer Controller for Kubernetes enables the configuration of AWS load balancers directly from Kubernetes resources. An Application Load Balancer (ALB) with an HTTPS listener on port 443 allows for secure communication over the gRPC protocol. With mutual TLS authentication, both the client and the backend server present certificates to each other, ensuring the identity of both parties. Configuring the ALB with HTTPS ensures that traffic between the client and the backend is encrypted in transit without decryption between them. By using the AWS Load Balancer Controller, the ALB can dynamically scale to handle thousands of simultaneous connections, working seamlessly with the Kubernetes Cluster Autoscaler and Horizontal Pod Autoscaler configurations.

I think that it's correct answer is B according to SPOTO products.