A bank migrates a payment API behind an Application Load Balancer and must enforce TLS 1.2 or higher, forward secrecy, and redirect all port 80 traffic, with quarterly proof that weak ciphers are disabled. Auditors require centrally managed ELB configuration and TLS policy evidence. Which ELB encryption enforcement control satisfies these transit requirements?

The correct control satisfies every stated transit requirement at once because HTTPS listeners on the Application Load Balancer with ELBSecurityPolicy-TLS13-1-2-2021-06 allow only TLS 1.2 and TLS 1.3 using forward-secret ECDHE suites, the port 80 listener uses a redirect action to HTTPS so no cleartext payment traffic is permitted, and AWS Config records listener and policy attachments to provide centrally managed evidence that weak ciphers stay disabled for quarterly review. The compatibility-oriented distractor that retains HTTP without redirect fails completeness of transit protection because cleartext remains reachable even when version, forward secrecy and Config are correct, violating the mandate to redirect all port 80 traffic. The logging-oriented distractor that substitutes ALB access logs for Config fails auditability because access logs show requests but do not evaluate and historicize the attached security policy, so auditors lack proof of continuous cipher enforcement. The cipher-compatibility distractor that permits non-forward-secret RSA key exchange fails cryptographic assurance because later private-key disclosure would expose past sessions despite correct version, redirect and Config tracking. As an exam caveat, distinguish request logging from configuration compliance, since only Config proves which TLS policy was enforced over time, and as a practical check, inspect listener certificates, security policy and redirect rule, then confirm the Config timeline shows continuous compliance across the quarter.