To add protection for encrypted sessions at Application Load Balancers by ensuring a unique random session key (forward secrecy), what should a network engineer do?

To ensure forward secrecy (FS) for encrypted sessions on Application Load Balancers (ALBs), a network engineer should change the ALB security policy to one that explicitly supports FS. Forward secrecy protects past session keys from being compromised if the server's long-term private key is later exposed. ALB security policies define the SSL/TLS protocols and ciphers that the load balancer uses. Selecting a policy that includes ciphers offering FS (like those using ephemeral Diffie-Hellman key exchange) is the direct way to implement this protection. Changing the ALB security policy to support TLS 1.2 only is insufficient because not all TLS 1.2 ciphers offer forward secrecy. Using AWS KMS to encrypt session keys is not directly related to ensuring forward secrecy at the ALB; KMS manages encryption keys, but the ALB's security policy dictates how session keys are generated and exchanged. Associating an AWS WAF web ACL with the ALBs and creating a security rule to enforce FS is incorrect as WAF operates at the application layer to filter web traffic based on rules, not to manage TLS/SSL session key negotiation or forward secrecy.