Exam ANS-C00 topic 1 question 36 discussion

If the SSL offload happens at ELB, correct answer is B - vulnerable ciphers and protocols can be removed on the security policy

Correct Answer D

HTTPS listener can be with SSL and without. As there is not stating that SSL cert is installed on listener we can't assume it is. So D can be reasonable answer

B - Agree with route53

B Elastic Load Balancing uses a TLS negotiation configuration, known as a security policy, to negotiate TLS connections between a client and the load balancer. A security policy is a combination of protocols and ciphers https://docs.amazonaws.cn/en_us/elasticloadbalancing/latest/network/create-tls-listener.html

I will go with B

This is a question about ELB, specifically the available listener configurations.. B is Correct. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.html

The key words here is "ELB with an HTTPS listener". This means SSL/TLS offloaded in the ELB. so only B match. Others are for web servers

It's a very frustrating question. It all depends on a condition that is unknown in the context of the question. What exactly are the vulnerabilities? Fact - ELBs does not allow you to define security policies. You have to choose the pre-defined security policies. So - D is ALWAYS right. Regardless of what vulnerabilities you have, you always have the option to define your own policies and deploy them into the web servers. B can be OK, but not guaranteed because if the ciphers and protocols deemed unsafe is there in all AWS pre-defined security policies you simply cannot remediate the problem through B.

I would go for B as well.

Correction.. .Ans B. "exploitable vulnerability .... in the encryption protocol and cipher" so just change the policy is correct. like from SSL to TLS

why not C... do you not create new Certs and then remove old " ...you must first create a new certificate by following the same steps that you used when you created the current certificate. Then, you can replace the certificate. "

It's B. security policy on ELB needs to be changed

B is correct

B ... !

D, because you want to use configuration management such as cloudformation to update ciphers and not doing it manually, its not scalable