A company runs an application in us-east-1 behind an ALB that receives HTTPS requests from vending machines worldwide. They plan to use AWS Global Accelerator and program the accelerator's static IPs into the vending machines so the application is reachable only through the accelerator, not directly via the internet-facing ALB URL. Which configuration will enforce access only through the accelerator?

The correct option ensures the ALB is not directly internet-accessible while still allowing Global Accelerator to reach it. Placing the ALB in private subnets, without route table entries to an Internet Gateway, prevents direct internet access. Global Accelerator, however, uses AWS's internal network to reach endpoints, bypassing the need for public routing to the ALB. The security group allowing inbound traffic "from the internet" on the ALB listener port is a standard configuration for ALBs that are targets of Global Accelerator; Global Accelerator's edge locations act as the source of this "internet" traffic from the ALB's perspective. The first incorrect option is missing the critical detail about route tables, which is essential for preventing direct internet access to the private subnet. The second incorrect option places the ALB in public subnets, making it directly internet-accessible and defeating the purpose. The third incorrect option incorrectly states that an Internet Gateway is attached and routes are added to private subnets, which would make them public. It also incorrectly restricts the security group to only accelerator IPs, which are dynamic and difficult to manage.