Question

A healthcare company runs a web application behind an Application Load Balancer. A compliance audit requires that all data transmitted between clients and the application be encrypted in transit, and that any plaintext HTTP requests be automatically upgraded to HTTPS without dropping the connection. The security team also wants to ensure the ALB only negotiates modern TLS versions. Which combination of ALB configuration steps meets these requirements with the least operational overhead?

Accepted Answer

Add an HTTPS listener with an ACM certificate and a modern predefined security policy, and configure an HTTP listener with a redirect action that returns HTTP 301 to HTTPS.

Answer

Add only an HTTPS listener with an ACM certificate, and rely on clients to always use the HTTPS endpoint.

Answer

Add an HTTP listener that forwards to the target group, and enable field-level encryption on the ALB to protect data in transit.

Answer

Configure a Network Load Balancer with TLS termination and use a self-signed certificate imported into ACM to encrypt traffic.