Question

A financial services company exposes a public web application through a global external Application Load Balancer. A compliance audit requires that the load balancer reject any client connections negotiating TLS versions below 1.2 and disable known-weak cipher suites, while still allowing modern browsers to connect. The security engineer must enforce this at the load balancer's frontend without modifying backend servers. What should the engineer do?

Accepted Answer

Create an SSL policy with profile set to MODERN or RESTRICTED and a minimum TLS version of 1.2, then attach it to the load balancer's target HTTPS proxy.

Answer

Configure a Cloud Armor security policy with a rule that inspects the TLS handshake and blocks requests using TLS 1.0 or 1.1.

Answer

Enable a firewall rule on the load balancer's forwarding rule that denies traffic on port 443 from clients using legacy cipher suites.

Answer

Install a custom TLS configuration on each backend instance and set the backend service protocol to HTTPS so weak ciphers are rejected end to end.