Request or import an SSL/TLS certificate in AWS Certificate Manager and associate it with the ALB and Create an HTTPS listener on the ALB that terminates TLS at the load balancer are correct because they move TLS processing off the EC2 instances and onto the load balancer.

When you Request or import an SSL/TLS certificate in AWS Certificate Manager and associate it with the ALB the ALB can present the certificate to clients and handle the TLS handshake. When you Create an HTTPS listener on the ALB that terminates TLS at the load balancer the ALB performs decryption and forwards plain HTTP traffic to the targets which reduces CPU usage on the servers.

Configure an HTTPS listener on the ALB that forwards encrypted traffic to targets without decryption (pass-through) is wrong because encryption remains end to end and the instances still perform the decryption so CPU stays high.

Install the ACM certificate directly on each EC2 instance to terminate TLS on the server is wrong because public ACM certificates are not exportable and you cannot install them on instances which means this would not offload TLS work.

Add AWS WAF on the ALB to reduce CPU from TLS is wrong because AWS WAF inspects application layer requests and does not remove the cost of TLS handshakes or decryption from the web servers.

Full AWS Practitioner Certification Question