A regional bank runs a customer portal on an Application Load Balancer with EC2 targets. Auditors require TLS 1.2 or higher for all connections, HTTP must redirect to HTTPS, and weak ciphers must be disabled at the load balancer. Which ELB security policy control enforces encrypted-only access to the portal?

The correct control pairs an ALB HTTPS listener using an ELB security policy restricted to TLS 1.2 or higher with an HTTP listener rule that redirects port 80 to 443, which ensures clients can only negotiate modern protocol versions with strong ciphers selected by AWS and any plaintext attempt is converted to HTTPS before serving the portal, directly meeting auditor demands for version enforcement, encrypted-only access, and load-balancer cipher control. The variant that forwards HTTP traffic to targets on port 80 maintains TLS for direct HTTPS hits but violates the redirect concept because forwarding preserves an unencrypted client path instead of returning a 301 redirect that forces HTTPS. The variant using a TLS 1.0-compatible policy correctly implements redirection yet fails the protocol-minimum concept because backward compatibility re-enables TLS 1.0 and 1.1 with associated weak ciphers that the TLS-1-2 policy family would remove. The variant that disables weak ciphers only on EC2 targets reflects correct modern-TLS intent and redirection but fails the enforcement-point concept because backend hardening does not constrain the client-to-load-balancer handshake, leaving the ALB able to negotiate weak ciphers in violation of the audit scope. For the exam, remember ALB security policies govern the frontend TLS negotiation, distinct from target-group TLS or backend encryption to EC2, and the HTTP listener itself must perform the redirect rather than relying on application logic. As a practical check, verify listeners with describe-listeners, confirm HTTP returns 301 to HTTPS with curl, and scan the endpoint to confirm TLS 1.0 and 1.1 are rejected and no weak ciphers are offered.