A healthcare startup runs internal microservices behind an Application Load Balancer and must encrypt all service-to-service traffic with TLS 1.3 using short-lived certificates and automated renewal. Private trust is required without public domain validation. Which certificate-based encryption in transit design meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
You need private trust without public domain validation, so AWS Private CA is a good fit. ACM automates renewal, and enforcing TLS 1.3 keeps the required protocol in place for your internal traffic.
Full Explanation
AWS Private CA provides private trust without public domain validation, and ACM automates renewal; Private CA can also issue short-lived certificates. Enforcing TLS 1.3 on the Application Load Balancer meets the protocol requirement, with TLS to the backends needed to keep service-to-service traffic encrypted end to end. Terminating TLS at the balancer and using HTTP between microservices leaves internal traffic unencrypted, contrary to the requirement. Allowing protocol negotiation for legacy dependencies can permit weaker TLS versions, so it does not enforce TLS 1.3. Issuing multi-year private certificates through ACM conflicts with the short-lived certificate requirement, even if the certificates are otherwise private and the load balancer enforces TLS 1.3. Exam caveat: private trust, automated renewal of short-lived certificates, and strict TLS 1.3 enforcement must all be met; satisfying only some of them is insufficient. As a practical check, review the ACM certificate validity period and renewal status, then inspect the ALB listener policy and target group protocol to confirm TLS 1.3 is used end to end rather than TLS being offloaded before an HTTP backend.