AmazonAmazon Advanced Networking Specialty ANS-C01 Certification·EN·Updated 3 Aug 2026
A global news site uses CloudFront with a custom domain service.example.com and an ALB origin at service-alb.example.com. Backend EC2 Windows instances are in an Auto Scaling group behind the ALB. Security policy requires encryption in transit for the entire path from users to backend. Which combination of changes is required to meet this policy? (Choose three.)
Choose an answer
Tap an option to check your answer.
Correct answer: Create a certificate for service.example.com by using AWS Certificate Manager (ACM). Configure CloudFront to use this custom SSL/TLS certificate. Change the default behavior to redirect HTTP to HTTPS., Create a public certificate from a third-party certificate provider with any domain name for the EC2 instances. Configure the backend to use this certificate for its HTTPS listener. Specify the instance target type during the creation of a new target group that uses the HTTPS protocol for its targets. Attach the existing Auto Scaling group to this new target group., Create a certificate for service-alb.example.com by using AWS Certificate Manager (ACM). On the ALB add a new HTTPS listener that uses the new target group and the service-alb.example.com ACM certificate. Modify the CloudFront origin to use the HTTPS protocol only. Delete the HTTP listener on the ALB..
Why this is the answer
The policy requires encryption end-to-end.
1. CloudFront to User: CloudFront needs an SSL/TLS certificate for service.example.com to serve content over HTTPS. ACM is the recommended and easiest way to provision certificates for CloudFront. Redirecting HTTP to HTTPS ensures all user traffic is encrypted. Self-signed certificates are not trusted by browsers, making that option incorrect.
2. CloudFront to ALB: The ALB needs an HTTPS listener with a certificate for service-alb.example.com. ACM is ideal for ALB certificates. CloudFront's origin protocol must be set to HTTPS to enforce encryption between CloudFront and the ALB. Deleting the ALB's HTTP listener prevents unencrypted access.
3. ALB to EC2 Instances: While the ALB handles the public-facing certificate, encryption between the ALB and EC2 instances is also required. This involves configuring the EC2 instances (or the application on them) to use HTTPS, and the ALB's target group must be configured to use the HTTPS protocol for health checks and forwarding. A public certificate (even self-signed if trusted by the ALB, though a public CA is more robust) is needed for the EC2 instances to present to the ALB. ACM certificates cannot be directly installed on EC2 instances for this purpose, so a third-party or self-signed certificate is necessary here.