ANS-C01 Exam - Question 1

Question

A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) duster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend.

Which solution will meet these requirements?

Examice · Accepted Answer

The service requires encryption in transit without decryption between the client and the backend. This can be achieved by using a Network Load Balancer (NLB) which operates at the transport layer (Layer 4), supporting TCP. By using a TLS listener on port 443, the traffic remains encrypted end-to-end. Mutual TLS (mTLS) can be implemented using NLB as it does not terminate the TLS connection, ensuring secure and continuous encryption. Therefore, the correct solution is to use a Network Load Balancer with a TLS listener to forward traffic to the backend service.

a724412639 · Answer

A: 
ALB does support HTTP/2 and gRPC workloads. However, the title mentions that the company needs to use mutual TLS for mutual authentication between the client and the backend. This means that traffic cannot be decrypted between the client and the service backend. Since the ALB will terminate the TLS connection and decrypt the traffic, it does not meet the requirements in the title.
In contrast, NLB can forward TCP traffic without decrypting the traffic, so it is more suitable for meeting the needs described in the title.

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-mutual-tls-authentication-for-applications-running-on-amazon-eks.html

Amazon_Dumps_com · Answer

B is valid answer ( BBB)

maxryan5335 · Answer

A is correct ( t.ly/AWSCertifiedAdvancedNetworkingSpecialty )

tromyunpak · Answer

now both A and B are correct before MTLS was only supported by NLB but last reinvent mtls is now supported on ALB also

43c89f4 · Answer

consider of 3 points 
1. gRPC protocol
2. thousands of connections
3. Mutula TLS

above 3 points supports ALB not NLB. hence answer would be B

dim912 · Answer

AAAAAAA

tromyunpak · Answer

B it is now true since Mtls is supported by the ALB

vikasj1in · Answer

The AWS Load Balancer Controller for Kubernetes enables the configuration of AWS load balancers directly from Kubernetes resources.
An Application Load Balancer (ALB) with an HTTPS listener on port 443 allows for secure communication over the gRPC protocol.
With mutual TLS authentication, both the client and the backend server present certificates to each other, ensuring the identity of both parties.
Configuring the ALB with HTTPS ensures that traffic between the client and the backend is encrypted in transit without decryption between them.
By using the AWS Load Balancer Controller, the ALB can dynamically scale to handle thousands of simultaneous connections, working seamlessly with the Kubernetes Cluster Autoscaler and Horizontal Pod Autoscaler configurations.

JoellaLi · Answer

I asked the 'Amazon Q'. And it said B is correct...

Raphaello · Answer

Correct answer is B.
ALB support gRPC, not NLB.
AWS Load Balancer Controller manage ALB for K8s cluster.

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/deploy-a-grpc-based-application-on-an-amazon-eks-cluster-and-access-it-with-an-application-load-balancer.html

ksdpmx · Answer

gRPC is not supported by NLB natively til now (2024/6)

AnakBellevue · Answer

I passed the test , almost all of questions from this practise, except couple. Get score 884

marfee · Answer

I think that it's correcty answer is A.

Marfee400704 · Answer

I think that it's correct answer is B according  to SPOTO products.

xTrayusx · Answer

Using an Application Load Balancer (ALB) with an HTTPS listener on port 443 ensures encryption of traffic in transit.

ExamFrontier · Answer

FYI. There are many new questions in the exam taken in June.

KienCT · Answer

I TINK A

ANS-C01 Exam - Question 1

Discussion