A retail site runs on multiple EC2 instances behind an Application Load Balancer and must be served over HTTPS. Which combination of steps should the SysOps administrator take? (Choose two.)

To serve a retail site over HTTPS using an Application Load Balancer (ALB), you need a TLS/SSL certificate. Requesting a public certificate from AWS Certificate Manager (ACM) is the most straightforward and cost-effective method for public-facing websites, as ACM handles renewal and deployment. Once obtained, this certificate must be associated with the Application Load Balancer. The ALB then offloads the SSL/TLS encryption and decryption, forwarding unencrypted (or re-encrypted) traffic to the EC2 instances, which simplifies instance configuration and improves performance. Installing the certificate directly on each EC2 instance is less efficient and harder to manage at scale compared to offloading to the ALB. Creating a private certificate in ACM is for internal use cases, not public-facing websites. Exporting and attaching the certificate directly to the application is also less efficient than using the ALB's built-in SSL offloading.