ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Adding a second HTTPS listener lets you apply different SSL policies on different ports. Re-configure the existing 443 listener to use an AWS TLS 1.2-only policy so public traffic cannot negotiate 3DES, eliminating the SWEET32 risk. Create a new listener on an alternate port (such as 8443) that uses a custom policy permitting only TLS 1.0 with AES128-SHA for the legacy controllers. Because an ALB's security group is applied to the entire load balancer and can include port-specific ingress rules, you can allow inbound traffic on port 8443 solely from the corporate CIDR while still allowing 0.0.0.0/0 on port 443. Simply enforcing TLS 1.2 on the current listener would break the controllers; moving TLS termination to the instances would add operational overhead and require other load-balancer changes; AWS WAF cannot filter by cipher suite, so it cannot address the SWEET32 exposure.