Exam AWS Certified Security - Specialty topic 1 question 28 discussion

Answer should be D. Classic load balancers support some of the legacy cipher suites. Given that some of the users are having problems could mean that legacy cipher suites have been deprecated in ALBs.

D...the aws document states something about disabling TLS if you want to support legacy clients https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

Application Load Balancers support only a specific set of TLS cipher suites. Many older browsers and devices can only communicate using outdated or less secure cipher suites, which ALBs now block for security purposes. This mismatch prevents these older systems from establishing a secure connection, leading to issues for users on those devices.

Answer should be B. Hear me out. What is DDOS? it floods traffic to the targeted online resources. That is where an Application Load balancer comes in, to redistribute the load, in the event of a DDoS attack, your site will not be down and will continue to function normally, most especially when the workload is distributed between two EC2 Instances.

C is rubbish, unsure how an intermediate certificate (installed via ACM, not via ALB) would cause some browsers not to work. D is much more likely

D: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

C is the correct one: "Follow the procedure to create a trail that applies to all Regions. A trail that applies to all Regions delivers log files from all Regions to an S3 bucket. After you create the trail, AWS CloudTrail automatically starts logging the events that you specified"

Likely historical ciphers misbehaving.

D. ALB may not support legacy ciphers.

You can use one of the ELBSecurityPolicy-TLS policies to meet compliance and security standards that require disabling certain TLS protocol versions, or to support legacy clients that require deprecated ciphers. Only a small percentage of internet clients require TLS version 1.0. To view the TLS protocol version for requests to your load balancer, enable access logging for your load balancer and examine the access logs.

D. The cipher suites on the Application Load Balancers are blocking connections.

D seems to be correct! Client on legacy ciphers can fail.

Answer is D:

Ans > D

Ans (D)

D is the correct answer..

I wasnt sure, but D make sense