How to Secure Public Website with OIDC Authentication Without Code Changes?

DVA-C02 By islever Editorial Last updated

Short answer

BC Create a public Application Load Balancer. Configure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration.

Question

A company has an internal website that contains sensitive data. The company wants to make the website public. The company must ensure that only employees who authenticate through the company's OpenID Connect (OIDC) identity provider (IdP) can access the website. A developer needs to implement authentication without editing the website. Which combination of steps will meet these requirements? (Choose two.)
  1. Create a public Network Load Balancer.
  2. Create a public Application Load Balancer. Correct Answer
  3. Configure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration. Correct Answer
  4. Configure a listener for the load balancer that listens on HTTP port 80. Add a default authenticate action providing the OIDC IdP configuration.
  5. Configure a listener for the load balancer that listens on HTTPS port 443. Add a default AWS Lambda action providing an Amazon Resource Name (ARN) to a Lambda authentication function.

Key Takeaways

Tests knowledge of ALB's built-in Layer 7 authentication versus custom implementations, with the common trap being HTTP usage or NLB/Lambda alternatives for secure, code-free access control.

Securing a public-facing web application using Amazon Application Load Balancer (ALB) native user authentication without modifying backend code. Community consensus confirms ALB with HTTPS and OIDC integration as the correct solution.

Common mistake: Option D (HTTP port 80) is frequently selected by candidates, but transmitting sensitive data and OIDC tokens over unencrypted HTTP violates security standards and breaks secure authentication flows.

Expert Analysis

Why the Answer Is Correct

Amazon Application Load Balancer (ALB) natively supports user authentication directly within its listeners, completely removing the need to modify the underlying web application code. By configuring an HTTPS listener on port 443 with an OIDC identity provider configuration, ALB intercepts incoming requests, redirects users to the IdP for credential verification, and validates the returned tokens before routing traffic to the target group. This architecture perfectly satisfies the requirement for secure, zero-code authentication while ensuring sensitive data remains encrypted in transit.

Why the Other Options Are Wrong

Network Load Balancer (NLB) operates exclusively at Layer 4 and performs TCP/UDP passthrough, meaning it cannot inspect HTTP headers or enforce user authentication rules, making option A invalid. Option D relies on HTTP port 80, which transmits authorization codes and session tokens in plaintext, creating severe security vulnerabilities for sensitive corporate data and OIDC flows. Option E mandates deploying a custom Lambda function for authentication logic, which directly contradicts the explicit exam constraint requiring implementation without editing the website or writing custom auth code.

Community Comment Notes

Multiple candidates confirmed BC as the definitive answer, highlighting that HTTPS is mandatory for securely exchanging OIDC tokens [1][5]. Top-voted comments pointed directly to the official AWS documentation explaining ALB listener authentication rules, which explicitly validate OIDC integration out-of-the-box [2]. Several users specifically called out HTTP (option D) as a critical security flaw for sensitive data, reinforcing why port 443 is strictly required in this scenario [3].

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always prioritize managed AWS networking features over custom code when the scenario specifies 'without modifying the application.' Remember that ALB handles Layer 7 authentication natively, while NLB is strictly a Layer 4 passthrough device. For any exam question involving sensitive data or identity providers, HTTPS is non-negotiable and should immediately rule out HTTP-based options.

Community Votes

BC
100%

100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. komorebi 👍 3
    The correct answer to ChetGPT is B, C
  2. aws_god 👍 2
    https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#configure-user-authentication
  3. jane_doe_1 👍 2
    BC. Since website contains sensitive data, I would use HTTPS port 433, instead of HTTP port 80.
  4. be1dca8 👍 1
    BD, The company wants to make the application public so we using HTTP will allow it to be public.
  5. 65703c1 👍 4
    BC is the correct answer.
Show 1 more comment
  1. seetpt 👍 3
    BC is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide