Amazon Exam SCS-C01 Topic 1 Question 54 Discussion

Actual exam question for Amazon's SCS-C01 exam

Question #: 54
Topic #: 1

An ecommerce company is developing new architecture for an application release. The company needs to implement TLS for incoming traffic to the application. Traffic for the application will originate from the internet TLS does not have to be implemented in an end-to-end configuration because the company is concerned about impacts on performance. The incoming traffic types will be HTTP and HTTPS The application uses ports 80 and 443.

What should a security engineer do to meet these requirements?

ACreate a public Application Load Balancer. Create two listeners one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443 Provision a public TLS certificate in AWS Certificate Manager (ACM). Attach the certificate to the listener on port 443.

BCreate a public Application Load Balancer. Create two listeners one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443 Provision a public TLS certificate in AWS Certificate Manager (ACM). Attach the certificate to the listener on port 80.

CCreate a public Network Load Balancer. Create two listeners one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443. Set the protocol for the listener on port 443 to TLS.

DCreate a public Network Load Balancer. Create a listener on port 443. Create one target group. Create a rule to forward traffic from port 443 to the target group. Set the protocol for the listener on port 443 to TLS.

Show Suggested Answer

Suggested Answer: A

An Application Load Balancer (ALB) is a type of load balancer that operates at the application layer (layer 7) of the OSI model. It can distribute incoming traffic based on the content of the request, such as the host header, path, or query parameters. An ALB can also terminate TLS connections and decrypt requests from clients before sending them to the targets.

To implement TLS for incoming traffic to the application, the following steps are required:

Create a public ALB in a public subnet and register the EC2 instances as targets in a target group.

Create two listeners for the ALB, one on port 80 for HTTP traffic and one on port 443 for HTTPS traffic.

Create a rule for the listener on port 80 to redirect HTTP requests to HTTPS using the same host, path, and query parameters.

Provision a public TLS certificate in AWS Certificate Manager (ACM) for the domain name of the application. ACM is a service that lets you easily provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services and your internal connected resources.

Attach the certificate to the listener on port 443 and configure the security policy to negotiate secure connections between clients and the ALB.

Configure the security groups for the ALB and the EC2 instances to allow inbound traffic on ports 80 and 443 from the internet and outbound traffic on any port to the EC2 instances.

This solution will meet the requirements of implementing TLS for incoming traffic without impacting performance or requiring end-to-end encryption. The ALB will handle the TLS termination and decryption, while forwarding unencrypted requests to the EC2 instances.

Verified Reference:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html

by Tarra at Feb 13, 2024, 09:41 AM

Limited Time Offer

25%

Off

Get Premium SCS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dominic

7 days ago

I don't think option B is correct, because you wouldn't want to attach the TLS certificate to the HTTP listener on port 80. That would just encrypt the traffic between the client and the load balancer, but not protect it all the way to the application.

upvoted 0 times

...

Toi

8 days ago

I'm leaning towards option A. Creating an Application Load Balancer with one listener on port 80 and one on port 443, and then forwarding the traffic from port 80 to the HTTPS listener on 443 seems like the most straightforward approach. Plus, we can use the AWS Certificate Manager to provision the TLS certificate and attach it to the HTTPS listener.

upvoted 0 times

...

Freeman

9 days ago

Haha, you know, I'm just imagining the exam proctor asking us, 'So, which one of you forgot to attach the TLS certificate to the right listener?' That would be a classic mistake to make on this question.

upvoted 0 times

...

Gail

10 days ago

Good point. And option C and D, using a Network Load Balancer, don't seem quite right either. They're talking about HTTP and HTTPS traffic, so an Application Load Balancer seems more appropriate.

upvoted 0 times

...