ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) / Question 1

SCS-C03 practice question: Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) (1 of 2)

Data Protection A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A payments processor exposes a public card-authorization API through an Application Load Balancer. Its PCI assessor requires that connections use TLS 1.2 or later, that older protocols such as TLS 1.0 and 1.1 are refused, and that every cipher suite provides forward secrecy.

Partner clients on modern stacks should negotiate TLS 1.3 when they support it. The certificate comes from AWS Certificate Manager, and the team wants to keep one HTTPS listener with no change to the application.

Which solution meets these requirements?

Choose one answer.

  1. A. Keep the default listener security policy, and add an AWS WAF rule that matches the JA3 fingerprint of clients that offer TLS 1.0 or 1.1. Leave the HTTPS listener and its certificate unchanged.
  2. B. Attach the predefined policy ELBSecurityPolicy-FS-1-2-Res-2020-10 to the HTTPS listener, which supports only TLS 1.2 with forward secrecy. Leave the certificate and application unchanged, since TLS 1.3 clients can still use TLS 1.2.
  3. C. Attach the predefined policy ELBSecurityPolicy-TLS13-1-0-2021-06 to the listener, which allows TLS 1.0 for older partners. Ask partners to move to TLS 1.2 within six months, and review the negotiated protocol in the access logs each month.
  4. D. Attach the predefined policy ELBSecurityPolicy-TLS13-1-2-2021-06 to the existing HTTPS listener. It supports only TLS 1.2 and TLS 1.3 with forward secrecy, and the ACM certificate stays on the listener unchanged.
Show the answer and explanation

Answer: D

  • A. Wrong: Fingerprint matching is a blocklist that a client can change, and it does not stop the listener from accepting TLS 1.0 handshakes. The default policy still allows older protocols, so the assessor requirement is not met by a WAF rule.
  • B. Wrong: The policy refuses older protocols and keeps forward secrecy, but it does not offer TLS 1.3. Partners that support TLS 1.3 would be held to TLS 1.2, which misses the stated requirement.
  • C. Wrong: This policy keeps accepting TLS 1.0 until every partner moves, which the assessor forbids. Reviewing access logs each month finds problems after they happen, rather than preventing them.
  • D. Right: Correct. This policy refuses TLS 1.0 and 1.1, offers only forward secrecy cipher suites, and lets clients that support TLS 1.3 negotiate it. The certificate and the application stay as they are. Learn more: Security policies for Application Load Balancers (opens in a new tab)

Explanation

A listener security policy sets which protocols and cipher suites the load balancer accepts. The predefined TLS 1.3 policy that includes TLS 1.2 refuses older protocols, keeps forward secrecy, and lets modern clients use TLS 1.3. The other options accept older protocols, drop TLS 1.3, or rely on a fingerprint blocklist.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)All Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) questions

Want more on Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)? The 5 full-length practice sets have 5 more Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets