SAP-C02 Question 49

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  To achieve true end-to-end encryption with an Application Load Balancer (ALB) for a web application, traffic must be encrypted from the client to the ALB, and then re-encrypted from the ALB to the backend EC2 instances. Client to ALB: You use AWS Certificate Manager (ACM) to provision a public SSL/TLS certificate and attach it to the ALB's HTTPS listener. ALB to EC2: You configure the ALB target group to use the HTTPS protocol (port 443). The ALB will establish a secure TLS connection with the backend instances. Because AWS does not allow exporting public ACM certificates, you must install a third-party or self-signed SSL certificate directly on the EC2 instances to handle this leg of the journey. (Note: The ALB does not validate the backend certificate's chain of trust or expiration date, so a standard third-party or self-signed certificate works perfectly for this internal encryption)

• Chose A1

  https://docs.aws.amazon.com/acm/latest/userguide/export-public-certificate.html After June 17, 2025, AWS introduced Exportable public certificates

• Chose C3

  Why option C is correct: End-to-end encryption implies traffic is encrypted both from the client to the load balancer and from the load balancer to the EC2 instances. Application Load Balancers (ALBs) support HTTPS termination at the ALB level using AWS Certificate Manager (ACM) certificates. To encrypt traffic between the ALB and EC2 instances, you must install a separate SSL/TLS certificate directly onto each EC2 instance. AWS Certificate Manager (ACM) certificates cannot be exported or installed directly on EC2 instances; thus, a third-party SSL certificate (such as from Let's Encrypt or a commercial provider) must be used on the EC2 instances themselves.