An ecommerce company is designing a new application architecture for an upcoming release. All client traffic originates from the internet. TLS must be terminated for inbound requests, but end-to-end TLS to the application is not required due to performance concerns. The application receives HTTP and HTTPS traffic on ports 80 and 443. What should a security engineer implement to meet these requirements?

The correct solution uses an Application Load Balancer (ALB) because it supports HTTP/HTTPS traffic, TLS termination, and content-based routing, including HTTP to HTTPS redirection. Creating separate listeners for HTTP (80) and HTTPS (443) allows the ALB to handle both protocols. Attaching the ACM certificate to the HTTPS listener enables TLS termination at the ALB, fulfilling the requirement. The redirect rule ensures all traffic uses HTTPS, improving security. A single target group simplifies management, as end-to-end TLS is not required. Incorrect options: Attaching the certificate to the HTTP listener is incorrect because HTTP is unencrypted and does not use certificates. Network Load Balancers (NLBs) operate at Layer 4 and do not support HTTP/HTTPS redirection or TLS termination for application-level protocols like ALBs do. They also cannot redirect HTTP to a TLS listener directly in the way an ALB can.