A cloud load balancer terminates TLS from clients and forwards requests to back-end application instances over unencrypted HTTP within the virtual network. A compliance requirement states that cardholder data must be encrypted throughout transmission. What should be done?
Select an answer to reveal the explanation.
Short Explanation
TLS termination at the load balancer is like a courier opening the sealed envelope at the lobby and walking the letter upstairs in plain sight. If the rule says encrypted all the way, you seal it again for the second leg, or let the envelope go straight through unopened. Network isolation isn't encryption, no matter how private the network feels.
Full Explanation
When a load balancer terminates TLS, it decrypts client traffic so it can inspect or route requests, and whatever it sends onward travels in whatever form the back-end connection uses. If that connection is plain HTTP, the data is exposed in cleartext on the virtual network, where it could be read by anything able to observe that traffic, such as a compromised instance or misconfigured mirroring. Meeting a requirement for encryption throughout transmission means either re-encrypting, so the load balancer opens a new TLS session to each back end using certificates the back ends present, or passing TLS through unterminated so the instances decrypt it themselves, at the cost of layer 7 features at the load balancer. Network isolation separates tenants and segments traffic, but isolated traffic is not encrypted traffic, and compliance requirements for encryption in transit are not satisfied by isolation alone. Encrypting storage volumes protects data at rest and does nothing for data moving between the load balancer and the instances. Moving components into the same subnet changes topology, not encryption; data still crosses the network unencrypted. Exam caveat: re-encryption requires certificate management for back-end instances, which ties to secrets, key and certificate management in objective 4.7. Operational check: capture traffic between the load balancer and a back end in a test environment and confirm it is TLS, and verify back-end certificate validation is enabled.