Which AWS load balancer supports TLS offload with ECC certificates and stateful sessions?

A company has an application that hosts personally identifiable information (PII) of users. All connections to the application must be secured by HTTPS with TLS certificates that implement Elliptic Curve Cryptography (ECC). The application uses stateful connections between the web tier and the end users. Multiple instances host the application. A network engineer must implement a solution that offloads TLS connections to a load balancer. Which load-balancing solution will meet these requirements?

Provision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS identity and Access Management (IAM). Turn on health checks to monitor the web hosts that connect to the end users.
Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Certificate Manager (ACM). Configure a default action to redirect to the URL for the application. Turn on health checks to monitor the web hosts that connect to the end users.
Provision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Certificate Manager (ACM). Turn on application-based session affinity (sticky sessions). Turn on health checks to monitor the web hosts that connect to the end users.
Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Identity and Access Management (IAM). Configure a default action to redirect to the URL for the application. Turn on application-based session affinity (sticky sessions). Source Reference Answer

Community Votes

73%

27%

73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The key is recognizing that stateful connections require application-based session affinity (sticky sessions), which is only available at Layer 7 (ALB), and that ECC certificates historically required IAM upload rather than ACM.

This question tests the ability to select the correct AWS load balancer for TLS offload using ECC certificates while maintaining stateful (sticky) sessions. Community consensus favors Application Load Balancer (ALB) with certificates uploaded to IAM, as NLB lacks application-based session affinity.

Many candidates choose Network Load Balancer (NLB) with ACM because NLB supports TLS listeners and ACM is the recommended certificate manager, but NLB does not support application-based sticky sessions required for stateful connections.

Community Discussion (9 comments)

DSExam 👍 2 Selected: D

You can upload certificate to IAM via aws cli. ACM did not support ECC-SSL at the time exam question were written, but they do now, for the purpose of this question you need to use IAM. https://repost.aws/knowledge-center/import-ssl-certificate-to-iam

woorkim 👍 1 Selected: D

A. Network Load Balancer with ECC SSL certificate in IAM: Network Load Balancers (NLBs) support TLS listeners but are designed for layer 4 (TCP) traffic. They lack features like session affinity and application-specific health checks. NLBs are not suitable for applications requiring sticky sessions or application-layer processing. B. ALB with health checks but no session affinity: This option misses the requirement for maintaining stateful connections. Without session affinity, the ALB may route user requests to different backend instances, breaking stateful communication. C. NLB with ECC SSL certificate in ACM and session affinity: NLB does not natively support application-based session affinity or sticky sessions. NLB is a layer 4 load balancer and is not optimal for this use case, which requires application-layer capabilities.

Christina666 👍 2 Selected: B

weird question, C and D both incorrect

imymoco 👍 1 Selected: C

c why use iam

MO_SAM 👍 1 Selected: D

Network load balancer does not the stickiness!! because stateful means you have to enable the sessions sickness which application layer 7

KobDragoon 👍 3 Selected: D

Considering the importance of sticky sessions for stateful connections in conjunction with the other requirements (end-to-end encryption, use of ECC certificates), Option D works better, even if managing the certificate with IAM instead of ACM feels weird, it is possible.

bluz 👍 4 Selected: D

NLB does not use application-based stickiness. For certificates in a Region supported by AWS Certificate Manager (ACM), we recommend that you use ACM to provision, manage, and deploy your server certificates. In unsupported Regions, you must use IAM as a certificate manager.

psou7 👍 3

i Vote C

backspace0900 👍 3 Selected: C

C ssl certificate managed acm

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Understanding the Requirements

The question presents several critical requirements:

1. TLS offload with ECC certificates: The load balancer must terminate HTTPS connections using Elliptic Curve Cryptography certificates. 2. Stateful connections: The application maintains session state between the web tier and end users, requiring session persistence (sticky sessions). 3. Multiple instances: The application is distributed across multiple hosts.

Why Application Load Balancer (ALB) is Required

The decisive factor is the requirement for stateful connections. This necessitates application-based session affinity (sticky sessions), which is a Layer 7 feature only available on the Application Load Balancer.

Network Load Balancer (NLB) operates at Layer 4 (TCP) and while it supports TLS listeners, it does not support application-based sticky sessions. NLB can only provide source IP affinity, which is insufficient for true application session persistence. This eliminates options A and C.

Certificate Management: IAM vs ACM

This is where the question becomes tricky. AWS Certificate Manager (ACM) is the recommended service for managing SSL/TLS certificates. However, at the time this question was written, ACM had limitations with ECC certificates.

As noted by community member DSExam: "ACM did not support ECC-SSL at the time exam question were written, but they do now." For the purpose of this exam question, you must use AWS Identity and Access Management (IAM) to upload the ECC certificate.

Community member bluz correctly points out: "In unsupported Regions, you must use IAM as a certificate manager." This historical context is crucial for understanding why Option D specifies IAM rather than ACM.

Why Option D is Correct

Option D correctly:

Provisions an Application Load Balancer (Layer 7, supports sticky sessions)
Configures an HTTPS listener for TLS offload
Uses an ECC SSL certificate uploaded to IAM (required for ECC at the time)
Enables application-based session affinity (sticky sessions for stateful connections)
Includes health checks for monitoring

Why Other Options Fail

Option A: NLB lacks application-based sticky sessions; uses IAM but wrong LB type
Option B: ALB is correct, but uses ACM (historically didn't support ECC); lacks sticky sessions configuration
Option C: NLB lacks application-based sticky sessions despite using ACM

The combination of Layer 7 features (sticky sessions) and the historical IAM requirement for ECC certificates makes Option D the only correct answer.

Official Reference

Exam Strategy

When you see 'stateful connections' or 'session persistence' in AWS load balancer questions, immediately think Layer 7 (ALB) and sticky sessions. NLB operates at Layer 4 and cannot provide application-based session affinity, regardless of TLS support.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide