A company will host a web application on EC2 instances and must load-balance traffic across instances. A security requirement mandates end-to-end encryption between the client and the web servers (TLS from client through the load balancer to the instances). Which design satisfies this requirement?

The correct option ensures end-to-end encryption by terminating TLS at the ALB and re-encrypting the connection to the EC2 instances. The ALB handles the client-facing certificate (from ACM), and the EC2 instances use their own certificate (third-party) for the connection from the ALB. This setup provides encryption for the entire path. The first incorrect option fails because ACM certificates cannot be exported and installed on EC2 instances. The second option uses CloudFront, which is for content delivery and not the primary load balancing component for this requirement; it also doesn't explicitly detail the instance-level encryption. The fourth option uses an NLB, which operates at Layer 4 and doesn't natively support SSL termination or re-encryption to instances for HTTP/HTTPS traffic.