A company is designing a web application with an internet-facing Application Load Balancer (ALB). The ALB must receive HTTPS traffic from the public internet, send only HTTPS traffic to EC2 web servers on port 443, and perform health checks over HTTPS on port 8443. Which combination of security group rules for the ALB will satisfy these requirements? (Choose three.)

The ALB needs to accept incoming HTTPS traffic from the internet, so an inbound rule allowing HTTPS (port 443) from 0.0.0.0/0 is required. The ALB also needs to forward HTTPS traffic to the EC2 instances on port 443, necessitating an outbound rule for HTTPS to the instances on port 443. Finally, the ALB performs health checks over HTTPS on port 8443, so an outbound rule for HTTPS to the instances on port 8443 is needed. The incorrect options involve inbound rules from the web application instances, which are not necessary for the ALB's function, or incorrect port/protocol combinations.