How to achieve end-to-end encryption and WAF protection with an ALB?

ANS-C01 By islever Editorial Last updated

Short answer

D Configure a third-party certificate on the EC2 instances for the communication between the ALB and the EC2 instances. Import the third-party certificate into AWS Certificate Manager (ACM). Associate the imported certificate with the ALB. Configure TLS connections to terminate at the ALB. Configure an AWS WAF web ACL. Associate the web ACL with the ALB.

Question

A company has a public application. The application uses an Application Load Balancer (ALB) that has a target group of Amazon EC2 instances. The company wants to protect the application from security issues in web requests. The traffic to the application must have end-to-end encryption. Which solution will meet these requirements?
  1. Configure a Network Load Balancer (NLB) that has a target group of the existing EC2 instances. Configure TLS connections to terminate on the EC2 instances that use a public certificate. Configure an AWS WAF web ACL. Associate the web ACL with the NLB.
  2. Configure TLS connections to terminate at the ALB that uses a public certificate. Configure AWS Certificate Manager (ACM) certificates for the communication between the ALB and the EC2 instances. Configure an AWS WAF web ACL. Associate the web ACL with the ALB.
  3. Configure a Network Load Balancer (NLB) that has a target group of the existing EC2 instances. Configure TLS connections to terminate at the EC2 instances by creating a TLS listener. Configure self-signed certificates on the EC2 instances for the communication between the NLB and the EC2 instances. Configure an AWS WAF web ACL. Associate the web ACL with the NLB.
  4. Configure a third-party certificate on the EC2 instances for the communication between the ALB and the EC2 instances. Import the third-party certificate into AWS Certificate Manager (ACM). Associate the imported certificate with the ALB. Configure TLS connections to terminate at the ALB. Configure an AWS WAF web ACL. Associate the web ACL with the ALB. Correct Answer

Key Takeaways

The core trap is the misconception that AWS Certificate Manager (ACM) cannot be used for backend (ALB-to-EC2) encryption; in reality, ACM certificates deployed to an ALB can be used to encrypt traffic to targets in the target group.

This question tests how to secure an Application Load Balancer (ALB) fronting EC2 instances with end-to-end encryption and AWS WAF. The community is split between B and D, with most choosing D because they believe ACM certificates cannot be used between the ALB and EC2 instances.

Common mistake: Many candidates choose D because they incorrectly believe ACM certificates cannot be used between an ALB and EC2 instances, leading them to import a third-party certificate onto the instances instead.

Expert Analysis

The correct answer is B. The scenario requires end-to-end encryption of web traffic and protection from web-based security issues, which points directly to an Application Load Balancer (ALB) combined with AWS WAF. An ALB natively supports TLS termination on the listener side and can also use an AWS Certificate Manager (ACM) certificate to encrypt traffic to the EC2 target group. This satisfies the end-to-end encryption requirement without requiring manual certificate management on the instances.

Why B is correct:

  • TLS terminates at the ALB using a public ACM certificate.
  • The ALB then re-encrypts traffic to the EC2 instances using another ACM certificate.
  • An AWS WAF web ACL is associated with the ALB to inspect and protect against web exploits.
  • This is the simplest, most AWS-native way to achieve end-to-end encryption.
Why D is wrong (despite being the suggested answer): Option D suggests importing a third-party certificate into ACM and using it for ALB-to-EC2 communication. While you can import third-party certs into ACM, it is unnecessary complexity. More importantly, the rationale often given by the community — that ACM cannot be used between ALB and EC2 — is incorrect. ACM certificates deployed to an ALB can be used to encrypt traffic to targets. The AWS documentation explicitly states that ACM integrates with Elastic Load Balancing to deploy certificates on the load balancer, and the ALB can use those certificates for backend encryption.

Why A and C are wrong:

  • A and C both propose using a Network Load Balancer (NLB). However, AWS WAF cannot be associated with an NLB; WAF only supports ALB, CloudFront, and API Gateway. This immediately disqualifies both options.
  • Additionally, C suggests using self-signed certificates, which is not a best practice for public-facing applications and complicates trust management.
Community consensus: The community is heavily split (71% D vs 29% B). Many candidates, including those in the comments, incorrectly state "You cannot use ACM's cert between EC2 and ALB" (comments [3], [4]). However, AWS documentation and real-world testing confirm that ACM certificates can be used for ALB-to-target encryption when the certificate is associated with the ALB's listener. Option B is the cleanest, most AWS-native solution that meets all requirements.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question mentions protecting web traffic and requires WAF, immediately eliminate any option involving a Network Load Balancer (NLB), as WAF does not support NLB. Then, prefer AWS-native services like ACM over third-party or self-signed certificates unless the scenario explicitly requires them.

Community Votes

D
71%
B
29%

71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. JoellaLi 👍 6 Answered D
    ACM certificates are supported by the following services: • Elastic Load Balancing To serve secure content over SSL/TLS, load balancers require that SSL/TLS certificates be installed on either the load balancer or the back-end Amazon EC2 instance. ACM is integrated with Elastic Load Balancing to deploy ACM certificates on the load balancer. • Amazon CloudFront To use an ACM certificate with CloudFront, make sure you request (or import) the certificate in the US East Region (us-east-1). • Amazon API Gateway With the proliferation of mobile devices and growth of the Internet of Things (IoT), it has become increasingly common to create APIs that can be used to access data and interact with back-end systems on AWS. • AWS Nitro Enclaves EC2 instances connected to Nitro Enclaves support ACM certificates. You cannot associate ACM certificates with an EC2 instance that is not connected to a Nitro Enclave.
  2. KobDragoon 👍 4 Answered B
    WAF for security and ACM managed certificate for TLS encryptions. B looks fine to me
  3. Blitz1 👍 3 Answered D
    The debate is between B and D ...(because the question is actually saying that ALB is already used -> NLB is excluded from the beginning) Even if ACM is more easier to use ( i mean you don't need to go to a third party provider) when reading B answer it is saying : "Configure AWS Certificate Manager (ACM) certificates for the communication between the ALB and the EC2 instances." You cannot use ACM for communication between ALB and EC2. Actually in the target group you can specify protocol and port and the instances associated but there is no field where to specify which certificate to use. Also in (B) it is not saying to configure the certificates in EC2 which is wrong as well. The ACM is used for ALB and in the listener part you have the default certificate and the SNIs under certificates tab. Therefore D is the correct answer.
  4. hedglin 👍 1
    B is correct. D is wrong, because this option involves using a third-party certificate, which adds complexity without providing any clear benefits over using ACM directly for certificate management. Terminating TLS at the ALB and applying the WAF ACL at the ALB level is correct, but the ALB's integration with ACM simplifies the process.
  5. Spaurito 👍 1
    D - You can import a certificate for use with ALB, CF, etc. If you need on your EC2 instances, you will need to import to them as well, but they can be used. Do this on a regular basis it seems.
Show 1 more comment
  1. VerRi 👍 1 Answered D
    You cannot use ACM's cert between EC2 and ALB.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide