A health insurer runs a claims API on EC2 instances behind a Network Load Balancer. Partner hospitals send claims over TLS, and the insurer's policy says that TLS must end on the insurer's own application instances, so that no load balancer or other intermediary can read the plaintext.
The partners also present client certificates, which the application must check itself. The design must support the current fleet and keep the load balancer health checks working.
Which solution meets these requirements?
Choose one answer.
AA. Create a TLS listener on the Network Load Balancer with an ACM certificate, and forward traffic to the instances over HTTP on port 80. The load balancer terminates TLS, and the instances process claims without certificates.
BB. Create a Network Load Balancer with a TCP listener on port 443, and forward the connections unchanged to the instances. Each instance terminates TLS with its own certificate, and the application checks partner client certificates.
CC. Create an Application Load Balancer with an HTTPS listener and an ACM certificate, and forward traffic to the instances over HTTP. Turn on client certificate verification on the listener, so the load balancer checks partner certificates.
DD. Create an Application Load Balancer with an HTTPS listener, and re-encrypt traffic to the instances over HTTPS with their own certificates. The instances then check partner client certificates themselves.
Show the answer and explanation
Answer: B
A. Wrong: The load balancer decrypts the traffic, so it can read plaintext, which the policy forbids. Plain HTTP between the load balancer and the instances also leaves claims unencrypted on the internal network.
B. Right: Correct. A TCP listener passes the encrypted stream through without decrypting it, so only the instance reads the claims. The instance TLS stack checks partner client certificates, and the load balancer health checks still work over TCP. Learn more: Listeners for your Network Load Balancer (opens in a new tab)
C. Wrong: The Application Load Balancer decrypts each request to read it and route it, which breaks the no-intermediary rule. The instances would also receive plaintext over HTTP.
D. Wrong: Re-encryption protects the second hop, but the load balancer still decrypts each request before it sends it on. The policy says no intermediary may read plaintext, so this design fails it.
Explanation
A TCP listener on a Network Load Balancer forwards encrypted traffic without terminating TLS, so the instance is the only endpoint that reads claims. The application then handles client certificate checks itself. Listeners that terminate TLS, including Application Load Balancer re-encryption, let an intermediary read the plaintext.
Want more on Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)? The 5 full-length practice sets have 5 more Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →