An application stores PII and requires all connections over HTTPS using TLS certificates that use Elliptic Curve Cryptography (ECC). The application has stateful connections between the web tier and end users and runs on multiple instances. The engineer must offload TLS to a load balancer and meet these requirements. Which load-balancing solution should be used?

The correct answer is an Application Load Balancer (ALB) because it supports HTTPS listeners for TLS offloading, including ECC certificates uploaded to IAM (or ACM), and crucially, it offers application-based session affinity (sticky sessions). Sticky sessions are essential for maintaining stateful connections between the web tier and end users, ensuring that requests from a specific user are consistently routed to the same application instance. The default action to redirect to the application URL is a standard ALB configuration. Network Load Balancers (NLBs) operate at Layer 4 and do not natively support application-based sticky sessions, which are required for stateful connections at the application layer. While NLBs can handle TLS offloading, their lack of application-level session affinity makes them unsuitable for this specific requirement. Using IAM for certificate storage is acceptable, as is ACM.