A citizen portal must enforce TLS 1.2 or higher for all public HTTPS entry points. Which design best provides encryption in transit with managed certificates on AWS?
Select an answer to reveal the explanation.
Short Explanation
Think of ACM on ALB, CloudFront, or API Gateway as the city’s official TLS lockset—citizens get HTTPS with modern TLS, and you are not hand-gluing expired PEMs into git. HTTP-only and FTP are non-starters for a portal.
Full Explanation
A citizen portal that must enforce TLS 1.2 or higher at all public HTTPS entry points should deploy ACM-managed certificates on Application Load Balancer, Amazon CloudFront, or API Gateway and select security policies or TLS policies that require modern protocol versions. ACM handles issuance and renewal, those edge services terminate TLS for internet clients, and policy knobs reject legacy SSL/early TLS so encryption in transit meets municipal baseline standards without operators embedding PEMs in application code.
Terminating with plaintext HTTP on an open security group and treating TLS as optional for mobile users fails confidentiality and the stated TLS 1.2+ mandate. Embedding expired certificates in application repositories and never renewing them fails trust, operational hygiene, and automated lifecycle—citizens see warnings or hard failures. Disabling HTTPS listeners and publishing an FTP site for form submissions fails modern secure-transport expectations and exposes form data to cleartext protocols unsuitable for a public portal.
Exam caveat: CloudFront, ALB, and API Gateway each expose TLS policy settings differently; verify the specific policy ID or minimum protocol version rather than assuming "HTTPS listener" equals TLS 1.2+. Operational check: run an SSL/TLS scanner against the public hostname, confirm TLS 1.0/1.1 are rejected, confirm the certificate chain is ACM-trusted, and re-test after certificate renewal windows to ensure automation remains healthy.