AWS Certified Security – Specialty (SCS-C02) — Question 144

A company deploys a distributed web application on a fleet of Amazon EC2 instances. The fleet is behind an Application Load Balancer (ALB) that will be configured to terminate the TLS connection. All TLS traffic to the ALB must stay secure, even if the certificate private key is compromised.

How can a security engineer meet this requirement?

Answer options

• A. Create an HTTPS listener that uses a certificate that is managed by AWS Certificate Manager (ACM).
• B. Create an HTTPS listener that uses a security policy that uses a cipher suite with perfect forward secrecy (PFS).
• C. Create an HTTPS listener that uses the Server Order Preference security feature.
• D. Create a TCP listener that uses a custom security policy that allows only cipher suites with perfect forward secrecy (PFS).

Correct answer: B

Explanation

The correct answer is B because using a cipher suite with perfect forward secrecy (PFS) ensures that even if the private key is compromised, past TLS sessions cannot be decrypted. Option A does not guarantee the same level of security regarding the private key. Option C does not directly address the requirement of maintaining security with a compromised key. Option D uses a TCP listener, which does not provide the same level of encryption and security features as an HTTPS listener.