An application processes credit card numbers and requires field-level encryption so only some components can decrypt sensitive fields. The customer-facing app runs as an ECS service behind an ALB in us-west-2, and CloudFront uses that ALB as the origin. Certificates come from a third-party CA and HTTPS is in use. Which combination of actions meets the requirements?

The correct options address two distinct requirements: SSL/TLS termination and field-level encryption. For SSL/TLS termination, CloudFront distributions require certificates to be in ACM in the us-east-1 region, regardless of the distribution's origin region. The ALB's certificate can be in the same region as the ALB (us-west-2). Therefore, importing the third-party certificate into ACM in us-west-2 for the ALB and uploading the certificate for CloudFront into ACM in us-east-1 is correct. The incorrect option of uploading the CloudFront certificate to us-west-2 would fail. For field-level encryption, CloudFront uses public key encryption to protect specific data fields. The client encrypts the data with a public key, and only the backend application with the corresponding private key can decrypt it. This process involves uploading the public key to CloudFront, creating a field-level encryption profile that specifies the fields to encrypt, and then creating a field-level encryption configuration that uses this profile and attaches it to the relevant cache behavior. Since credit card numbers are typically submitted via POST requests, attaching the configuration to the cache behavior handling POST requests is appropriate. The incorrect options either specify uploading a private key (which should never be exposed) or incorrectly order the steps.