How to Secure Public Website with OIDC Authentication Without Code Changes?
A company has an internal website that contains sensitive data. The company wants to make the website public. The company must ensure that only employees who authenticate through the company's OpenID Connect (OIDC) identity provider (IdP) can access the website. A developer needs to implement authentication without editing the website. Which combination of steps will meet these requirements? (Choose two.)
Community Votes
100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of ALB's built-in Layer 7 authentication versus custom implementations, with the common trap being HTTP usage or NLB/Lambda alternatives for secure, code-free access control.
Securing a public-facing web application using Amazon Application Load Balancer (ALB) native user authentication without modifying backend code. Community consensus confirms ALB with HTTPS and OIDC integration as the correct solution.
Option D (HTTP port 80) is frequently selected by candidates, but transmitting sensitive data and OIDC tokens over unencrypted HTTP violates security standards and breaks secure authentication flows.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon Application Load Balancer (ALB) natively supports user authentication directly within its listeners, completely removing the need to modify the underlying web application code. By configuring an HTTPS listener on port 443 with an OIDC identity provider configuration, ALB intercepts incoming requests, redirects users to the IdP for credential verification, and validates the returned tokens before routing traffic to the target group. This architecture perfectly satisfies the requirement for secure, zero-code authentication while ensuring sensitive data remains encrypted in transit.Why the Other Options Are Wrong
Network Load Balancer (NLB) operates exclusively at Layer 4 and performs TCP/UDP passthrough, meaning it cannot inspect HTTP headers or enforce user authentication rules, making option A invalid. Option D relies on HTTP port 80, which transmits authorization codes and session tokens in plaintext, creating severe security vulnerabilities for sensitive corporate data and OIDC flows. Option E mandates deploying a custom Lambda function for authentication logic, which directly contradicts the explicit exam constraint requiring implementation without editing the website or writing custom auth code.Community Comment Notes
Multiple candidates confirmed BC as the definitive answer, highlighting that HTTPS is mandatory for securely exchanging OIDC tokens [1][5]. Top-voted comments pointed directly to the official AWS documentation explaining ALB listener authentication rules, which explicitly validate OIDC integration out-of-the-box [2]. Several users specifically called out HTTP (option D) as a critical security flaw for sensitive data, reinforcing why port 443 is strictly required in this scenario [3].Official Reference
Exam Strategy
Always prioritize managed AWS networking features over custom code when the scenario specifies 'without modifying the application.' Remember that ALB handles Layer 7 authentication natively, while NLB is strictly a Layer 4 passthrough device. For any exam question involving sensitive data or identity providers, HTTPS is non-negotiable and should immediately rule out HTTP-based options.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →