A SysOps admin consolidated multiple secure websites onto a single server, each site bound to a different TCP port. The admin plans to launch a duplicate server in another Availability Zone and place both behind a load balancer for high availability. Which AWS CLI command will install one of the site certificates onto the load balancer listener?

The correct command is aws elb set-load-balancer-listener-ssl-certificate. This command is specifically designed for Classic Load Balancers (ELB) to associate an SSL certificate with a listener. The question implies a Classic Load Balancer setup by referring to "load balancer" without specifying Application or Network Load Balancer, and the command syntax aligns with Classic ELB. The --load-balancer-name identifies the load balancer, --load-balancer-port specifies the listener port (typically 443 for HTTPS), and --ssl-certificate-id provides the ARN of the certificate. The other options are incorrect. aws kms modify-listener is not a valid AWS CLI command for managing load balancer certificates. aws ec2 put-ssl-certificate and aws acm put-ssl-certificate are also not valid commands for this purpose; certificates are typically managed in AWS Certificate Manager (ACM) or uploaded to IAM, and then referenced by the load balancer.