MENU
A media company is implementing a news website for a global audience. The website uses Amazon CloudFront as its content delivery network. The backend runs on Amazon EC2 Windows instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The company's customers access the website by using service example com as the CloudFront custom domain name. The CloudFront origin points to an ALB that uses service-alb.example.com as the domain name.
The company's security policy requires the traffic to be encrypted in transit at all times between the users and the backend.
Which combination of changes must the company make to meet this security requirement? (Choose three.)
Suggested Answer: B, D, E
Get Premium ANS-C01 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
17 comments · newest first
NI
Nichelle
11 months ago
D sounds good too, but third-party certs can be a hassle.
MA
Marget
12 months ago
I agree with B, it's the best practice to use ACM for SSL.
EM
Emiko
12 months ago
Wait, why would you use a self-signed cert? Seems sketchy.
JO
Johana
1 year ago
I think A is a bit risky with self-signed certs.
LE
Lenna
1 year ago
Definitely B and E for sure!
KA
Katy
1 year ago
I recall that we need to ensure all traffic is encrypted, so I think we definitely need to configure the ALB with an HTTPS listener. Options C and D seem relevant, but I’m not sure which one is better.
CL
Clay
1 year ago
I'm a bit confused about whether we should create a self-signed certificate or use ACM for the ALB. I feel like option E might be the way to go since it talks about modifying the CloudFront origin.
CA
Carla
1 year ago
I remember a practice question where we had to redirect HTTP to HTTPS. I think option B sounds right because it mentions using a custom SSL certificate for CloudFront.
AL
Alberto
1 year ago
I think we need to use AWS Certificate Manager for the SSL certificate, but I'm not sure if it should be for the CloudFront domain or the ALB.
RO
Rolf
1 year ago
I recall that we had a question about using HTTPS listeners on the ALB, but I can't remember if we should use a public certificate or if ACM is sufficient.
VI
Vivan
1 year ago
I’m a bit confused about whether we need a certificate for the ALB or just for the CloudFront distribution. I feel like both might be necessary to ensure end-to-end encryption.
JU
Juliann
1 year ago
I think option B sounds familiar because we practiced similar questions about configuring CloudFront with ACM certificates. Redirecting HTTP to HTTPS is definitely a must.
CA
Carlee
1 year ago
I remember we discussed the importance of using AWS Certificate Manager for SSL certificates, but I'm not sure if a self-signed certificate is the best option for production.
BA
Basilia
1 year ago
I'm a bit confused about the KPIs and dashboards. Do service templates really contain those, or is that something else? I'll have to guess on those parts.
TE
Tegan
1 year ago
Okay, I think I've got this. First, I'll SSH into the worker1 node and enforce the AppArmor profile, then I'll update the manifest file and create the pod. Shouldn't be too bad.
JO
Jodi
1 year ago
Hmm, I'm a bit unsure about this one. I know business exceptions are related to business rules and requirements, but I'm not sure how to apply that here. I'll have to think it through step-by-step.
SH
Sheron
1 year ago
I'm a bit confused by this question. I'm not sure which one is the wrong statement. I'll have to review my notes on independent testing.