A multi-tier application is being hosted on a single EC2 instance in a VPC without an ELB. You have been instructed to set it up with separate SSL certificates for each tier. Which of the following would be the best method to achieve this while leaving the application running on a single EC2 instance?

Answer options:

A.Create an EC2 instance that has multiple network interfaces with multiple elastic IP addresses.
B.Create an EC2 instance that has both an ACL and the security group attached to it and have separate rules for each IP address.
C.Create an EC2 instance that has multiple subnets attached to it and each will have a separate IP address.
D.Create an EC2 instance with a NAT address.

Answer – A
It can be useful to assign multiple IP addresses to an instance in your VPC to do the following.
(1) Host multiple websites on a single server by using multiple SSL certificates on a single server and associating each certificate with a specific IP address.
(2) Operate network appliances, such as firewalls or load balancers, that have multiple IP addresses for each network interface.
(3) Redirect internal traffic to a standby instance if your instance fails by reassigning the secondary IP address to the standby instance.
Option A is CORRECT because, as mentioned above, if you have multiple elastic network interfaces (ENIs) attached to the EC2 instance, each network IP can have a component running with a separate SSL certificate.
Option B is incorrect because having separate rules in the security group as well as NACL does not mean that the instance supports multiple SSLs.
Option C is incorrect because an EC2 instance cannot have multiple subnets.
Option D is incorrect because the NAT address is not related to supporting multiple SSLs.
For more information on Multiple IP Addresses, please refer to the link below.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/MultipleIP.html