A company requires HTTPS for access to its web applications. The applications run on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. A security engineer must ensure the load balancer only accepts connections on port 443, even if an HTTP listener is accidentally configured. Which configuration accomplishes this?

The correct option ensures that only HTTPS traffic on port 443 reaches the ALB. Security groups are stateful and control traffic at the instance/ENI level. By creating a security group that explicitly allows only port 443 from all sources (0.0.0.0/0) and associating only this security group with the ALB, any accidental HTTP listener on port 80 will be blocked by the security group before it can reach the ALB. The first incorrect option (denying port 80 in a security group) is less effective because security groups are allow-list based; a deny rule won't override an explicit allow. The second and third incorrect options involve Network ACLs associated with the internet gateway, which is not the correct placement for controlling traffic to an ALB within a VPC. Network ACLs are stateless and operate at the subnet level, not directly on the ALB.