Answer-first summary for fast verification
Answer: Configure a TLS listener. Deploy the server certificate on the NLB.
## Explanation **Correct Answer: A** **Why Option A is correct:** 1. The question specifically asks about improving **security of data in transit** (data moving between client and server). 2. A Network Load Balancer (NLB) operates at Layer 4 (transport layer) and can terminate TLS connections. 3. By configuring a TLS listener and deploying a server certificate on the NLB, you enable encryption for data in transit between clients and the NLB. 4. This ensures that sensor data from users' devices is encrypted during transmission over the internet. **Why other options are incorrect:** **Option B:** - AWS Shield Advanced provides DDoS protection, which is about availability, not specifically about encrypting data in transit. - AWS WAF (Web Application Firewall) protects against web exploits but doesn't encrypt data in transit. - NLB doesn't support AWS WAF integration (only ALB and CloudFront support WAF). **Option C:** - Changing to ALB and enabling WAF adds web application security but doesn't directly address encryption of data in transit. - While ALB can terminate TLS, the question already has an NLB, and simply enabling WAF doesn't encrypt data. - This option adds unnecessary complexity by changing infrastructure when the existing NLB can already handle TLS termination. **Option D:** - Encrypting EBS volumes protects **data at rest** (stored data), not data in transit. - EBS encryption secures data on disk but doesn't affect network traffic between clients and servers. **Key Concepts:** - **Data in transit** vs **data at rest**: Different security measures apply to each. - **TLS termination at NLB**: NLBs can terminate TLS connections at Layer 4, providing encryption for client-to-NLB traffic. - **Certificate management**: Server certificates must be deployed on the load balancer for TLS termination. - **Security layers**: DDoS protection (Shield), web application security (WAF), and encryption (TLS) address different security concerns.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A company has a three-tier application on AWS that ingests sensor data from its users' devices. The traffic flows through a Network Load Balancer (NLB), then to Amazon EC2 instances for the web tier, and finally to EC2 instances for the application tier. The application tier makes calls to a database. What should a solutions architect do to improve the security of the data in transit?
A
Configure a TLS listener. Deploy the server certificate on the NLB.
B
Configure AWS Shield Advanced. Enable AWS WAF on the NLB.
C
Change the load balancer to an Application Load Balancer (ALB). Enable AWS WAF on the ALB.
D
Encrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances by using AWS Key Management Service (AWS KMS).