A telehealth startup must secure browser-to-ALB and microservice-to-microservice traffic, enforce modern TLS, automate public certificate renewal, and issue private certs for internal mTLS. Which certificate management design using TLS 1.3 and AWS issuance best meets the in-transit encryption need?

The correct design works because ACM public certificates on ALB provide managed browser-to-load-balancer encryption with automatic public renewal, a TLS 1.3 policy enforces modern protocol versions and strong ciphers, and Private CA supplies a dedicated private hierarchy for issuing internal certificates that enable mutual authentication between microservices without exposing private names publicly, satisfying edge, east-west, protocol, lifecycle and trust requirements together. The TLS 1.2 design fails on protocol enforcement because it preserves older negotiation despite otherwise correct public automation and private issuance, directly missing the mandated TLS 1.3 baseline. The public-only design fails on trust scope because public certificates are intended for internet-trusted identities and cannot provide private namespace isolation, private revocation control, or appropriate internal naming for mTLS at scale. The imported-certificate design fails on lifecycle automation because third-party certificates imported to ACM require manual renewal and redeployment and lose native AWS automatic renewal, breaking the automation need even with correct policies and private mTLS. For exams, remember to check whether encryption is required only at the edge or also service to service, since many stems add mTLS specifically to rule out edge-only answers. Practically, confirm the ALB listener uses a TLS 1.3 security policy with an ACM-managed ARN showing renewable status and test service-to-service calls fail closed without valid Private CA-issued client certificates.