Which ALB Security Group Rules Enable HTTPS and Port 8443 Health Checks?
Short answer
ACE The ALB security group needs inbound HTTPS on 443 from 0.0.0.0/0 plus outbound HTTPS to the EC2 instances on 443 and on 8443 for health checks.
Question
Key Takeaways
The exam tests whether you can separate inbound listener traffic from the ALB's outbound traffic to targets, and remember that health check ports are governed by the ALB's egress rules, not by the incoming listener rule.
An internet-facing Application Load Balancer needs security group rules that accept public HTTPS on port 443 and send HTTPS to EC2 targets on both 443 (application traffic) and 8443 (health checks). The correct three-rule combination is A, C, and E.
Common mistake: Choosing option B (allow all outbound traffic to 0.0.0.0/0 on 443) or option D (inbound from the instances): B over-permits egress to the entire internet instead of scoping it to the web servers, and D reverses the traffic flow, since the instances never initiate connections to the ALB.
Expert Analysis
Why the Answer Is Correct
A security group attached to an internet-facing ALB must solve two separate traffic problems: public clients connecting to the listener, and the ALB connecting onward to its registered targets. Option A covers the first problem by allowing HTTPS inbound on port 443 from 0.0.0.0/0, which is exactly how browsers reach a public ALB listener. Options C and E cover the second problem: the ALB opens outbound connections to the EC2 instances, once on port 443 for user requests and once on port 8443 for the HTTPS health check. Because the question asks for a combination of security group configurations for the ALB itself, the answer is A, C, and E.
Why the Other Options Are Wrong
Option B allows all outbound traffic to 0.0.0.0/0 on port 443, which is broader than required — the ALB only needs to reach the web application instances, so an egress rule scoped to those instances or their security group is correct. Option D allows inbound HTTPS from the web application instances on 443, but the instances never initiate traffic to the ALB; that rule belongs on the instance security group as an inbound rule sourced from the ALB security group, not on the ALB security group. Option E's counterpart on inbound (none is listed) is also unnecessary, confirming that only A, C, and E describe valid ALB-side rules.
Community Comment Notes
spoved linked the AWS Application Load Balancer documentation and quoted the line "The following rules are recommended for an internet-facing load balancer," which is the exact vendor guidance this question mirrors. dhewa and aragon_saa both walked through the three rules — inbound 443 from the internet, outbound 443 to the instances, and outbound 8443 for health checks — as the intended answer. JoeTromundo raised a fair critique that the question is poorly worded because security groups allow all outbound traffic by default, so C and E would not strictly need to be configured; he suggested the real configuration gap is an instance security group allowing inbound from the ALB security group, which is a useful distinction even though the exam still keys on A, C, and E.
Exam Strategy
When an SAA-C03 question names the security group "associated with the ALB," answer only about rules that live on the load balancer: one inbound rule for the listener port and outbound rules for every port the ALB opens toward the targets, including the health check port. Read the stem carefully for the phrase "(Choose three)" so you do not stop after the two obvious listener and forwarding rules.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Map every port in the scenario to a direction: 443 inbound from the internet is a listener rule, while 443 and 8443 outbound are target and health check rules on the ALB security group. Because the stem says "Choose three," expect one inbound plus two outbound answers and reject any option that reverses the traffic direction.
Frequently Asked Questions
Why is option B (allow all outbound to 0.0.0.0/0 on 443) wrong for the ALB security group?
Does the ALB security group need an inbound rule from the instance security group, as option D suggests?
Community Votes
100% of anonymous learners picked answer ACE. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
dhewa 👍 4A. This allows the ALB to receive HTTPS traffic from the public internet. C. This ensures that the ALB can send HTTPS traffic to the web application servers. E. This allows the ALB to perform health checks on the web application servers over HTTPS on port 8443.
-
[Removed] 👍 3A. Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443. This allows the ALB to receive HTTPS traffic from the public internet on port 443. C. Allow HTTPS outbound traffic to the web application instances for port 443. This allows the ALB to forward HTTPS traffic to the web application servers on port 443. E. Allow HTTPS outbound traffic to the web application instances for the health check on port 8443. This allows the ALB to perform health checks on the web application servers over HTTPS on port 8443.
-
JoeTromundo 👍 3This question is poorly worded: assuming that, by default in security groups, all OUTBOUND connections are ALLOWE and all INBOUND connections are DENIED, options C and E would not even need to be configured. What would be needed is to create a security group for the EC2 instances allowing INBOUND connections from the ALB security group to the EC2 instances security group on ports 443 and 8443.
-
spoved 👍 3https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-update-security-groups.html The following rules are recommended for an internet-facing load balancer.
-
aragon_saa 👍 2Answer is ACE
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →