You ' ve been hired to design a highly available application consisting of web, application,...

Option B provides both an appropriate security boundary and an optimized delivery path. Alibaba Cloud CDN should be the Internet-facing content-delivery layer so that cacheable HTTPS resources are served from edge points of presence close to users. Alibaba Cloud currently supports directly configuring an ALB instance domain as a CDN origin, producing the request path client → CDN → ALB → backend server. This prevents clients from bypassing the load-balancing tier and preserves centralized health checking and traffic distribution.

The backend ECS instances should remain on private network addresses rather than being individually Internet-exposed. For an Internet-facing ALB, external traffic reaches the ALB through its public EIP and is then forwarded internally to backend ECS private IP addresses. This substantially reduces the attack surface while retaining public application availability.

Options C and D unnecessarily expose ECS instances through public networking. Option A uses private ECS instances, but making the individual application servers the CDN origins bypasses the ALB ' s centralized distribution and availability functions. Therefore, CDN → ALB → private ECS is the strongest architecture.

Study Guide reference: Delivering Content on Alibaba Cloud; Delivering Services on Alibaba Cloud; Highly Available Architecture.

==================================================