AWS Certified Advanced Networking – Specialty (ANS-C00) — Question 80

An organization is deploying an application in a VPC that requires SSL mutual authentication with a client-side certificate, as that is the primary method of identifying clients. The Network Engineer has been tasked with defining the mechanism used within AWS to provide the SSL mutual authentication.
Which of the following options meets the organization's requirements?

Answer options

• A. Use a Classic Load Balancer and upload the client certificate private keys to it. Perform SSL mutual authentication of the client-side certificate there.
• B. Use a Network Load Balancer with a TCP listener on port 443, and pass the request through for the SSL mutual authentication to be handled by a backend instance.
• C. Use an Application Load Balancer and upload the client certificate private keys to it by using the native server name indication (SNI) features with smart certificate selection to handle multiple calling applications.
• D. Front the application with Amazon API Gateway, and use its client-side SSL mutual authentication feature that uses the backend instances to verify the source of the request.

Correct answer: C

Explanation

The correct answer is C because an Application Load Balancer supports SSL termination, including client certificate validation, and can handle multiple applications using SNI. Option A is incorrect as Classic Load Balancers do not support client certificate validation. Option B does not provide SSL termination at the load balancer level, which is essential for mutual authentication. Option D, while offering a feature for SSL mutual authentication, does not meet the requirement as effectively as option C does.