A company has 10 web-server EC2 instances in an Auto Scaling group in a production VPC and 10 web servers on-premises. A 10 Gbps Direct Connect links the data center to the VPC. The solution must accept HTTPS from thousands of external users and distribute sessions across both AWS and on-prem servers. Each HTTPS request must stick to the same backend server for the entire session regardless of server location. Which design satisfies these requirements?

The correct design uses an Application Load Balancer (ALB) because it operates at Layer 7 (HTTP/HTTPS) and can handle application-based session affinity (sticky sessions), which is required for HTTPS requests to stick to the same backend server. Specifying 'ip' as the target type allows the ALB to register both EC2 instances (by their private IPs) and on-premises servers (by their private IPs accessible via Direct Connect) within the same target group. Enabling application-based session affinity ensures that subsequent requests from a user are routed to the same server. Network Load Balancers (NLBs) are incorrect because they operate at Layer 4 and do not support application-based sticky sessions, which are necessary for HTTPS sessions. Using 'instance' as the target type is incorrect because it only allows registering EC2 instances, not on-premises servers.