Which AWS load balancer supports TLS offload with ECC certificates and stateful sessions?

ANS-C01 By islever Editorial Last updated

Short answer

D Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Identity and Access Management (IAM). Configure a default action to redirect to the URL for the application. Turn on application-based session affinity (sticky sessions).

Question

A company has an application that hosts personally identifiable information (PII) of users. All connections to the application must be secured by HTTPS with TLS certificates that implement Elliptic Curve Cryptography (ECC). The application uses stateful connections between the web tier and the end users. Multiple instances host the application. A network engineer must implement a solution that offloads TLS connections to a load balancer. Which load-balancing solution will meet these requirements?
  1. Provision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS identity and Access Management (IAM). Turn on health checks to monitor the web hosts that connect to the end users.
  2. Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Certificate Manager (ACM). Configure a default action to redirect to the URL for the application. Turn on health checks to monitor the web hosts that connect to the end users.
  3. Provision a Network Load Balancer. Configure a TLS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Certificate Manager (ACM). Turn on application-based session affinity (sticky sessions). Turn on health checks to monitor the web hosts that connect to the end users.
  4. Provision an Application Load Balancer. Configure an HTTPS listener by specifying the use of an ECC SSL certificate that is uploaded to AWS Identity and Access Management (IAM). Configure a default action to redirect to the URL for the application. Turn on application-based session affinity (sticky sessions). Correct Answer

Key Takeaways

The key is recognizing that stateful connections require application-based session affinity (sticky sessions), which is only available at Layer 7 (ALB), and that ECC certificates historically required IAM upload rather than ACM.

This question tests the ability to select the correct AWS load balancer for TLS offload using ECC certificates while maintaining stateful (sticky) sessions. Community consensus favors Application Load Balancer (ALB) with certificates uploaded to IAM, as NLB lacks application-based session affinity.

Common mistake: Many candidates choose Network Load Balancer (NLB) with ACM because NLB supports TLS listeners and ACM is the recommended certificate manager, but NLB does not support application-based sticky sessions required for stateful connections.

Expert Analysis

Understanding the Requirements

The question presents several critical requirements:

1. TLS offload with ECC certificates: The load balancer must terminate HTTPS connections using Elliptic Curve Cryptography certificates. 2. Stateful connections: The application maintains session state between the web tier and end users, requiring session persistence (sticky sessions). 3. Multiple instances: The application is distributed across multiple hosts.

Why Application Load Balancer (ALB) is Required

The decisive factor is the requirement for stateful connections. This necessitates application-based session affinity (sticky sessions), which is a Layer 7 feature only available on the Application Load Balancer.

Network Load Balancer (NLB) operates at Layer 4 (TCP) and while it supports TLS listeners, it does not support application-based sticky sessions. NLB can only provide source IP affinity, which is insufficient for true application session persistence. This eliminates options A and C.

Certificate Management: IAM vs ACM

This is where the question becomes tricky. AWS Certificate Manager (ACM) is the recommended service for managing SSL/TLS certificates. However, at the time this question was written, ACM had limitations with ECC certificates.

As noted by community member DSExam: "ACM did not support ECC-SSL at the time exam question were written, but they do now." For the purpose of this exam question, you must use AWS Identity and Access Management (IAM) to upload the ECC certificate.

Community member bluz correctly points out: "In unsupported Regions, you must use IAM as a certificate manager." This historical context is crucial for understanding why Option D specifies IAM rather than ACM.

Why Option D is Correct

Option D correctly:

  • Provisions an Application Load Balancer (Layer 7, supports sticky sessions)
  • Configures an HTTPS listener for TLS offload
  • Uses an ECC SSL certificate uploaded to IAM (required for ECC at the time)
  • Enables application-based session affinity (sticky sessions for stateful connections)
  • Includes health checks for monitoring

Why Other Options Fail

  • Option A: NLB lacks application-based sticky sessions; uses IAM but wrong LB type
  • Option B: ALB is correct, but uses ACM (historically didn't support ECC); lacks sticky sessions configuration
  • Option C: NLB lacks application-based sticky sessions despite using ACM
The combination of Layer 7 features (sticky sessions) and the historical IAM requirement for ECC certificates makes Option D the only correct answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see 'stateful connections' or 'session persistence' in AWS load balancer questions, immediately think Layer 7 (ALB) and sticky sessions. NLB operates at Layer 4 and cannot provide application-based session affinity, regardless of TLS support.

Community Votes

D
73%
C
27%

73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. bluz 👍 4 Answered D
    NLB does not use application-based stickiness. For certificates in a Region supported by AWS Certificate Manager (ACM), we recommend that you use ACM to provision, manage, and deploy your server certificates. In unsupported Regions, you must use IAM as a certificate manager.
  2. KobDragoon 👍 3 Answered D
    Considering the importance of sticky sessions for stateful connections in conjunction with the other requirements (end-to-end encryption, use of ECC certificates), Option D works better, even if managing the certificate with IAM instead of ACM feels weird, it is possible.
  3. DSExam 👍 2 Answered D
    You can upload certificate to IAM via aws cli. ACM did not support ECC-SSL at the time exam question were written, but they do now, for the purpose of this question you need to use IAM. https://repost.aws/knowledge-center/import-ssl-certificate-to-iam
  4. Christina666 👍 2 Answered B
    weird question, C and D both incorrect
  5. woorkim 👍 1 Answered D
    A. Network Load Balancer with ECC SSL certificate in IAM: Network Load Balancers (NLBs) support TLS listeners but are designed for layer 4 (TCP) traffic. They lack features like session affinity and application-specific health checks. NLBs are not suitable for applications requiring sticky sessions or application-layer processing. B. ALB with health checks but no session affinity: This option misses the requirement for maintaining stateful connections. Without session affinity, the ALB may route user requests to different backend instances, breaking stateful communication. C. NLB with ECC SSL certificate in ACM and session affinity: NLB does not natively support application-based session affinity or sticky sessions. NLB is a layer 4 load balancer and is not optimal for this use case, which requires application-layer capabilities.
Show 4 more comments
  1. MO_SAM 👍 1 Answered D
    Network load balancer does not the stickiness!! because stateful means you have to enable the sessions sickness which application layer 7
  2. backspace0900 👍 3 Answered C
    C ssl certificate managed acm
  3. psou7 👍 3
    i Vote C
  4. imymoco 👍 1 Answered C
    c why use iam

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide