You are working as an AWS consultant for a banking institute. They have deployed a digital wallet platform for clients using multiple EC2 instances in the us-east-1 region. The application establishes a secure encrypted connection between clients & EC2 instances for each transaction using custom TCP port 5810.
Due to the increasing popularity of this digital wallet, they observe load on backend servers resulting in delay in transaction. For security purpose, all client IP address accessing this application should be preserved & logged. The technical team of the banking institution is looking for a solution that will address this delay & also proposed solution should be compatible with millions of transactions done simultaneously. Which of the following is a recommended option to meet this requirement?

Answer options:

A.Use Network Load Balancers with SSL certificate. Configure TLS Listeners on this NLB with custom security policy consisting of protocols & ciphers.
B.Use Network Load Balancers with SSL certificate. Configure TLS Listeners on this NLB with default security policy consisting of protocols & ciphers.
C.Use Network Load Balancers with SSL certificate. Configure TLS Listeners on this NLB with default security policy consisting of protocols & TCP port 5810.
D.Use Network Load Balancers with SSL certificate. Configure TLS Listeners on this NLB with custom security policy consisting of protocols & TCP port 5810.

Correct Answer – B
Network Load Balancer can terminate TLS connections instead of back end instance, reducing the load on this instance. With Network Load Balancers, millions of simultaneous sessions can be established with no impact on latency along with preserving client IP address. To negotiate TLS connections with clients, NLB uses a security policy that consists of protocols & ciphers.
Option A is incorrect as Network Load Balancers does not support a custom security policy.
Option C is incorrect as Network Load Balancers should consist of security policies comprising of Protocols & Ciphers.
Option D is incorrect as Network Load Balancers do not support custom security policy, and security policies should comprise protocols & ciphers.
For more information on Security Policies for TLS termination on Network Load Balancers, refer to the following URL-
https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html