ACM Integration with ALB and Route 53

Why the Answer Is Correct

A social media web application is inherently public-facing, requiring a certificate issued by a publicly trusted Certificate Authority so that end-user browsers do not show security warnings. AWS Certificate Manager (ACM) public certificates are designed exactly for this purpose and can be directly associated with an Application Load Balancer (ALB). In Route 53, configuring an Alias A record to point to the ALB is the AWS best practice, as it provides highly available and cost-free routing compared to a standard CNAME record.

Why the Other Options Are Wrong

Options B and C incorrectly use private certificates on the ALB, which would cause browser trust errors for public internet clients because private certificates are signed by a private CA. Option D unnecessarily complicates the architecture by attempting to configure a private certificate on the backend EC2 instances; while private certificates can be exported for EC2, the prompt does not require end-to-end TLS encryption. Furthermore, Option D uses a standard A record pointing to the ALB domain name (acting as a CNAME) rather than the preferred Alias record, which is less efficient at the zone apex.

Community Comment Notes

As Gramterre noted, "You need to present a certificate signed by a public authority to the web application clients." This reinforces that a public ACM certificate is mandatory for a public-facing application, and the Route 53 record must point to the ALB alias.