A fintech runs a customer portal on EC2 behind an Application Load Balancer that currently accepts HTTP on port 80 and HTTPS with an old TLS policy. Auditors require encrypted client connections with TLS 1.2 or higher and no plain HTTP access. Which ELB security policy control enforces encryption for load balancer connections?
Select an answer to reveal the explanation.
Short Explanation
You've got to shut the plain HTTP door while raising the bar on TLS. Redirect rules plus a modern ELB policy are your one-two punch for audit-proof encryption.
Full Explanation
An ALB HTTPS listener bound to a modern predefined security policy such as ELBSecurityPolicy-TLS13-1-2-2021-06 negotiates only strong protocols and ciphers, satisfying the TLS 1.2 or higher requirement, while an HTTP listener rule that returns a 301 redirect to HTTPS guarantees clients cannot remain on plaintext. Retaining the old 2016-08 policy with an unchanged HTTP listener fails the encryption requirement because it still permits weak protocols and plaintext access. Terminating TLS via TCP passthrough on instances decentralizes certificate management and loses centralized policy enforcement at the load balancer. Using a Network Load Balancer TLS listener without a redirect leaves HTTP available if an ALB or other entry point still serves it, so it does not enforce encryption for all balancer connections. For the exam remember predefined ELB policies are versioned and you select them on the listener, not via SGs, and in practice verify with SSL Labs and check AWS Config rule for ALB HTTP to HTTPS redirection.