A company is migrating an application to a new AWS account in a single Region. The app runs on EC2 instances in private subnets across multiple Availability Zones. Users connect via HTTPS from browsers. Inbound traffic must be balanced across AZs and instances, and all connections from the same client session must go to the same EC2 instance. The company also requires end-to-end encryption using the application SSL certificate. Which design meets these requirements?

This option correctly identifies the need for a Network Load Balancer (NLB) to handle the high performance and low latency required, while also supporting end-to-end encryption with the application's SSL certificate. Setting the target group and listener protocols to TCP on port 443 allows the NLB to pass encrypted traffic directly to the EC2 instances, where the SSL termination occurs. This ensures end-to-end encryption. Session affinity (sticky sessions) on the NLB ensures that connections from the same client are routed to the same instance. The other options are incorrect because: An Application Load Balancer (ALB) would terminate SSL at the load balancer, not on the EC2 instances, thus not providing end-to-end encryption with the application's certificate. Setting the NLB target group protocol to TLS would also terminate SSL at the NLB. An HTTP listener on an ALB would not handle HTTPS traffic.