SSL/TLS termination in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does SSL/TLS termination affect backend servers?

When SSL/TLS termination is configured on a load balancer, what is the effect on the backend servers?

A Backend servers receive encrypted traffic and must decrypt it themselves.

B Backend servers receive unencrypted traffic because the load balancer decrypts it first.

C Backend servers do not receive any traffic; the load balancer handles all requests internally.

D Backend servers receive traffic encrypted with a different certificate than the client.

💡 Hint

Think about where the encryption ends when SSL/TLS termination is used.

SSL/TLS termination means the load balancer decrypts the traffic before sending it to backend servers, so backend servers get unencrypted traffic.

❓ Architecture

intermediate

Choosing SSL/TLS termination location for a web app

You have a web application hosted on AWS behind an Application Load Balancer (ALB). You want to secure client connections with HTTPS. Which option correctly describes where SSL/TLS termination should be configured for best practice?

A Do not use SSL/TLS termination; let clients connect over HTTP directly to backend instances.

B Configure SSL/TLS termination only on backend instances; ALB forwards encrypted traffic.

C Configure SSL/TLS termination on both ALB and backend instances simultaneously.

D Configure SSL/TLS termination on the ALB so it handles HTTPS and forwards HTTP to backend instances.

💡 Hint

Consider where it is easier to manage certificates and reduce backend load.

Terminating SSL/TLS at the ALB centralizes certificate management and reduces CPU load on backend servers.

❓ security

advanced

Security risk of SSL/TLS termination at load balancer

What is a potential security risk when SSL/TLS termination is done at the load balancer and traffic between the load balancer and backend servers is unencrypted?

A SSL/TLS termination at load balancer causes data loss during transmission.

B Clients will see certificate errors because backend servers do not have certificates.

C Backend servers can be exposed to man-in-the-middle attacks on internal network if it is not secure.

D Load balancer cannot decrypt traffic, causing connection failures.

💡 Hint

Think about what happens to data after decryption at the load balancer.

After SSL/TLS termination, traffic between load balancer and backend is unencrypted. If the internal network is not secure, attackers could intercept this traffic.

❓ Configuration

advanced

AWS CLI command to create SSL/TLS listener on ALB

Which AWS CLI command correctly creates an HTTPS listener on an existing Application Load Balancer with SSL/TLS termination using a specified certificate ARN?

A aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol HTTPS --port 443 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

B aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol HTTP --port 80 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

C aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol HTTPS --port 80 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

D aws elbv2 create-listener --load-balancer-arn <alb-arn> --protocol TCP --port 443 --certificates CertificateArn=<cert-arn> --default-actions Type=forward,TargetGroupArn=<tg-arn>

💡 Hint

Remember HTTPS uses port 443 and the protocol must be HTTPS for SSL termination.

The correct command uses protocol HTTPS on port 443 with the certificate ARN specified to enable SSL/TLS termination on the ALB listener.

✅ Best Practice

expert

Optimal SSL/TLS termination strategy for multi-tier AWS app

You have a multi-tier web application in AWS with a public Application Load Balancer (ALB) in front, an internal Network Load Balancer (NLB) for backend services, and EC2 instances behind the NLB. You want to ensure end-to-end encryption with minimal latency and simplified certificate management. Which SSL/TLS termination strategy is best?

A Terminate SSL/TLS at the ALB, re-encrypt traffic with HTTPS to the NLB, and terminate SSL/TLS at backend EC2 instances.

B Terminate SSL/TLS at the ALB and NLB, forwarding unencrypted traffic to backend EC2 instances.

C Terminate SSL/TLS only at the NLB, forwarding encrypted traffic from ALB to NLB and backend instances.

D Terminate SSL/TLS at the ALB, use HTTP between ALB and NLB, and terminate SSL/TLS again at backend EC2 instances.

💡 Hint

Consider how to keep encryption end-to-end while managing certificates efficiently.

Terminating SSL/TLS at ALB and re-encrypting to NLB, then terminating again at backend ensures encryption on every segment. It balances security and certificate management.