You are designing an SSL/TLS solution that requires HTTPS clients to be authenticated by the Web server using client certificate authentication. The solution must be resilient. Which of the following options would you consider for configuring the web server infrastructure? Choose 2 answers from the options below

Answer options:

A.Configure ELB with TCP listeners on TCP/443. And place the Web servers behind it.
B.Configure your Web servers with EIP’s. Place the Web servers in a Route53 Record Set and configure health checks against all Web servers.
C.Configure ELB with HTTPS listeners, and place the Web servers behind it.
D.Configure your web servers as the origins for a CloudFront distribution. Use custom SSL certificates on your CloudFront distribution.

Answer - A and B
Option A is correct because end instance will handle SSL Athentication. TLS connection does not terminate on the ELB and on the backend servers its decrypted while passing through it.
Option B is correct because we can use Web Servers directly along with Route 53 and ELB can be removed.
Option C is incorrect because Client side certifciations is not supported by ELB with HTTPs
Option D is incorrect because Cloudfront does not support Client side certification.