Exam AWS Certified Security - Specialty topic 1 question 121 discussion

While not the most Ideal solution, C will protect the certificate installed on the ELB, if both the elb and server used the same cert, a breach of the application would allow possible export of the certificate and key pair, using a self signed cert between the elb and server would only expose the self signed cert and keep the external communication between viewers and the ELB safe since they use the external cert

C A: This would not help because they are only using a single certificate. B: Should use different certificate. D: Not encrypted always.

The answer is C The comment that says "if both elb and server used the same cert", clearly missed the "INTERNAL CERT" part. There 2 distinct certs, one external on ELB, and an internal on the instance, to ensure end to end encryption.

Answer A: using a NLB with TCP listener

Guys Ans is A: Look at what AWS has to say: To use a TLS listener, you must deploy at least one server certificate on your load balancer. The load balancer uses a server certificate to terminate the front-end connection and then to decrypt requests from clients before sending them to the targets. Note that if you need to pass encrypted traffic to the targets without the load balancer decrypting it, create a TCP listener on port 443 instead of creating a TLS listener. The load balancer passes the request to the target as is, without decrypting it. https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html

A. Using a Network Load Balancer (NLB) to pass through traffic on port 443 from the internet to port 443 on the instances is the most suitable approach in this scenario. NLB operates at the transport layer (Layer 4) and allows for direct forwarding of traffic to the instances without terminating the SSL/TLS connection at the load balancer. This means that the SSL/TLS encryption and decryption are handled by the application servers themselves, reducing the exposure of the external certificate. By using this approach, the SSL/TLS encryption remains intact between the client and the application servers, protecting the data in transit.

C is the best answer because AWS recommends using AWS Certificate Manager to create or import certificates to the Elastic Load Balancer.

Answer is C

Answer C

NLB with a combination of port 443 , that ensures secured HTTPS traffic . I think A

Answer C

Answer: C the key where is protect the external certificate. Duplicated question.

C, for sure

answer: c