A healthcare portal on an Application Load Balancer must enforce encrypted browser connections, block deprecated TLS versions, and automatically redirect cleartext requests. Auditors will test the listener configuration and cipher negotiation. Which ELB mechanism enforces encrypted transit for this workload?
Select an answer to reveal the explanation.
Short Explanation
You're forcing encryption at the front door, not just opening ports. A modern security-policy negotiates only strong ciphers and TLS versions. It's like upgrading locks and auto-closing the old entrance.
Full Explanation
An ALB HTTPS listener with a managed ELB security policy such as TLS 1.2 plus forward secrecy defines the exact protocols and ciphers the load balancer will negotiate, rejecting deprecated versions during the handshake, and pairing it with an HTTP listener rule that returns a permanent redirect guarantees cleartext is never served. A security group allowing 443 plus Proxy Protocol only controls network reachability and client IP preservation, doing nothing to mandate TLS version or redirect port 80. ALB access logs with WAF improve auditability and layer-7 filtering but cannot perform the TLS handshake or enforce cipher selection. A TCP listener on 443 with HTTPS health checks passes through encrypted bytes without terminating or validating policy, leaving weak clients able to negotiate and HTTP still reachable. On the exam, look for listener plus security policy as the encryption control versus WAF and groups as complementary. In practice, verify with SSL Labs and confirm ACM certificate renewal and HSTS headers.