A recreation department booking website must present only HTTPS to citizens and redirect any HTTP requests to HTTPS. Which design best implements that control on AWS?
Select an answer to reveal the explanation.
Short Explanation
Citizens booking ball fields deserve a locked HTTPS door, not a swinging HTTP screen door. ACM hands you a trusted cert on ALB or CloudFront, and a listener rule politely redirects HTTP to HTTPS.
Full Explanation
Citizen-facing booking sites must present HTTPS and redirect plain HTTP so browsers always land on encrypted sessions. The Associate-level implementation is AWS Certificate Manager certificates attached to an Application Load Balancer or Amazon CloudFront, plus listener or cache-behavior rules that issue HTTP-to-HTTPS redirects (typically 301/302 to the HTTPS URL). ACM removes certificate private-key handling from operators, ALB/CloudFront terminate TLS correctly for public users, and redirect rules close the "user typed http://" gap without leaving a working cleartext application path.
Terminating TLS with a self-signed certificate stored in a public S3 bucket fails trust and key hygiene: browsers warn citizens, and publishing key material to S3 is the opposite of managed certificates. Disabling encryption and advertising HTTP-only bookmarks fails confidentiality for personal booking data and passwords. Placing plaintext HTTP behind a security group that allows only UDP 53 fails both protocol design and encryption—DNS allowance does not secure an HTTP website.
Exam caveat: redirects alone are incomplete if the HTTPS listener uses weak policies; prefer modern TLS policies on ALB/CloudFront and HSTS where the application stack supports it. Operational check: request http:// on the public hostname and confirm a redirect to https://, validate the served certificate is ACM-issued and trusted, and confirm no alternate listener still serves application content in cleartext.