A new citizen mobile backend-for-frontend terminates users at CloudFront, then reaches an ALB and private origins. Which encryption-in-transit design should architects mandate?
Select an answer to reveal the explanation.
Short Explanation
Encrypt the whole hallway: citizen to CloudFront, CloudFront to ALB, ALB to origin. Dropping to cleartext behind the edge is leaving the inner doors unlocked.
Full Explanation
A citizen mobile backend-for-frontend that terminates users at CloudFront then reaches an ALB and private origins must keep data encrypted across the entire path. Enforcing TLS on viewer-to-CloudFront, CloudFront-to-ALB, and ALB-to-origin connections prevents cleartext segments inside the city's edge and VPC path. Terminating TLS at CloudFront and forwarding cleartext HTTP to ALB and origins simplifies certificates while exposing traffic on internal hops. Using HTTP everywhere and relying on security groups for confidentiality confuses access control with encryption. Disabling HTTPS on the ALB because mobile apps might pin cleartext endpoints violates transport security expectations for citizen data. Exam caveat: certificate management and TLS policy versions must be consistent across CloudFront and ALB listeners. Operational check: trace a request with logging or packet inspection in a lab VPC to confirm TLS on each hop, fail a deliberate HTTP origin attempt, and verify mobile clients reject plaintext endpoints. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.