How to achieve end-to-end encryption and WAF protection with an ALB?

The correct answer is B. The scenario requires end-to-end encryption of web traffic and protection from web-based security issues, which points directly to an Application Load Balancer (ALB) combined with AWS WAF. An ALB natively supports TLS termination on the listener side and can also use an AWS Certificate Manager (ACM) certificate to encrypt traffic to the EC2 target group. This satisfies the end-to-end encryption requirement without requiring manual certificate management on the instances.

Why B is correct:

• TLS terminates at the ALB using a public ACM certificate.
• The ALB then re-encrypts traffic to the EC2 instances using another ACM certificate.
• An AWS WAF web ACL is associated with the ALB to inspect and protect against web exploits.
• This is the simplest, most AWS-native way to achieve end-to-end encryption.

Why D is wrong (despite being the suggested answer): Option D suggests importing a third-party certificate into ACM and using it for ALB-to-EC2 communication. While you can import third-party certs into ACM, it is unnecessary complexity. More importantly, the rationale often given by the community — that ACM cannot be used between ALB and EC2 — is incorrect. ACM certificates deployed to an ALB can be used to encrypt traffic to targets. The AWS documentation explicitly states that ACM integrates with Elastic Load Balancing to deploy certificates on the load balancer, and the ALB can use those certificates for backend encryption.

Why A and C are wrong:

• A and C both propose using a Network Load Balancer (NLB). However, AWS WAF cannot be associated with an NLB; WAF only supports ALB, CloudFront, and API Gateway. This immediately disqualifies both options.
• Additionally, C suggests using self-signed certificates, which is not a best practice for public-facing applications and complicates trust management.

Community consensus: The community is heavily split (71% D vs 29% B). Many candidates, including those in the comments, incorrectly state "You cannot use ACM's cert between EC2 and ALB" (comments [3], [4]). However, AWS documentation and real-world testing confirm that ACM certificates can be used for ALB-to-target encryption when the certificate is associated with the ALB's listener. Option B is the cleanest, most AWS-native solution that meets all requirements.