SAA-C03 Q660 · Security

Question

A company hosts an end-user application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company needs to configure end-to-end encryption between the ALB and the EC2 instances. Which solution will meet this requirement with the LEAST operational effort?

Accepted Answer

**Wait — this answer is actually tricky and requires careful analysis.**

The question asks for end-to-end encryption between the ALB and EC2 instances with the **least operational effort**.

**Important nuance about ACM certificates:**
- ACM-issued certificates **cannot be exported** — their private keys are managed entirely by AWS.
- ACM-issued certificates can only be directly deployed on **integrated AWS services** (ALB, CloudFront, API Gateway, etc.).
- ACM-issued certificates **cannot be installed on EC2 instances** directly.

**However, the answer D is selected as correct because:**
- For the ALB side: ACM certificates work natively — zero effort.
- For the EC2 side: You can use **ACM with Nitro Enclaves** or the question may be interpreted as using ACM Private CA to issue certifica

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips