A public application uses an Application Load Balancer (ALB) with an EC2 instance target group. The company wants to protect the app from malicious web requests and ensure end-to-end encryption. Which configuration will meet these requirements?

The correct option ensures end-to-end encryption and protection. Terminating TLS at the ALB using a public certificate (either from ACM or imported) handles client-to-ALB encryption. Installing a third-party certificate on EC2 instances for the ALB-to-instance connection provides encryption for the backend path, achieving end-to-end. AWS WAF can be associated directly with an ALB to protect against malicious web requests. Incorrect options: Replacing ALB with NLB and associating WAF with NLB is incorrect because WAF cannot be directly associated with an NLB. NLBs operate at Layer 4, while WAF operates at Layer 7. Terminating TLS at the ALB and using ACM certificates for ALB-to-EC2 server-side connections is not how ACM certificates are used for backend connections; ACM primarily provides public certificates for front-end termination. Using an NLB with WAF is incorrect as WAF does not integrate directly with NLB. Installing self-signed certificates on EC2 instances for NLB-to-instance connection is generally not recommended for production due to trust issues and management overhead.