Exam AWS Certified Security - Specialty topic 1 question 5 discussion

B i Think

B is correct , first it mentioned custom protocols and ALBs only support HTTP & HTTPS listeners, CLBs support TCP,SSL/TLS,HTTP & HTTPS listeners . Second , it says encryption in transit between hosts and EC2 which means end-end encryption and not terminating or off-loading the session on the laod balancer , so only answer that terminates Session on EC2 is B.

B seems to be the most suitable. It ensures that all traffic remains encrypted in transit, meeting the compliance requirements. The TLS termination occurs at the EC2 instances, which allows for handling custom proprietary protocols effectively. This setup also leverages the benefits of a load balancer for increased availability without compromising security.

I will go with B, Route all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances

Anything that state routing traffic through SSL/HTTPS can be removed, since the question states it's a custom protocol (so remove A, C and D). That leaves B

B is correct. This question is outdated newer documentation would recommend avoiding the classical load balancer and using the network load balancer instead.

The question states that we must encrypt data in transit between the remote network and the EC2 machines. B

Answer is B

I think C is the correct option. "creates an HTTPS listener using an Application Load Balancer. " indicates that traffic will be encrypted in transit

How is Routing traffic through TCP listener encrypt traffic? sure, the connection can be built over TCP, but we still don't have encryption? Confused on why B ?

If you need to pass encrypted traffic to targets without the load balancer decrypting it, you can create a Network Load Balancer or Classic Load Balancer with a TCP listener on port 443. With a TCP listener, the load balancer passes encrypted traffic through to the targets without decrypting it. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

Custom protocols and ALBs only support HTTP & HTTPS listeners, CLBs support TCP,SSL/TLS,HTTP & HTTPS listeners . Also the question says encryption in transit between hosts and EC2 which means end-end encryption and not terminating or off-loading the session on the laod balancer , so only answer that terminates Session on EC2 is B

I think C

I agree with INASR. Well done.

B APPLICATION LOAD BALANCER DOESN'T SUPPORT TCP

A is correct Only TCP allows proprietary protocols as requested.

B is the correct answer.