Resident PII moves from a public citizen portal to internal APIs and must remain encrypted in transit across public TLS termination and private backend hops. Which design best satisfies encryption-in-transit requirements?
Select an answer to reveal the explanation.
Short Explanation
Encrypting the front door and then whispering secrets down an open hallway is not really encryption in transit. Keep TLS (or equal crypto) on the private hops too after the ALB or CloudFront. Cleartext inside the VPC still exposes resident PII to anyone on that path.
Full Explanation
Resident PII that moves from a public citizen portal to internal APIs must stay encrypted in transit on every hop that carries it. Terminate TLS at the public-facing load balancer or CloudFront using ACM certificates for the citizen edge, then continue TLS—or equivalent encrypted transport—on private hops to internal APIs so intermediate VPC segments do not carry cleartext PII. End-to-end confidentiality is a chain; edge termination alone is not enough when backends still speak HTTP.
Terminating TLS at the edge and forwarding HTTP cleartext on all internal VPC segments exposes PII to anyone who can sniff or compromise an intermediate hop, violating the encryption-in-transit requirement. Disabling TLS on the public portal to improve mobile latency trades resident privacy for speed and fails basic public-site hygiene. Transmitting PII only in URL query strings over HTTP is both cleartext and cache-hostile, leaking sensitive values into logs and intermediaries.
Exam caveat: “TLS to the load balancer” questions often hide a second requirement for backend encryption; mTLS may appear in zero-trust designs, but the core idea is no cleartext PII on intermediate segments. Operational check: verify HTTPS listeners and redirects at the edge, confirm target groups or service meshes use TLS to APIs, run a packet capture or TLS-required health check on the private hop, and ensure application logs do not record PII query strings.