A company exposes a TLS service through a TCP NLB listener. Security requires the target application to terminate client TLS without load-balancer decryption. Which configuration fits?

1. Use an HTTP ALB listener and forward unencrypted requests to targets.
2. Use a TLS listener and assume the NLB never terminates client TLS.
3. Use TCP pass-through and configure the application targets to terminate TLS.
4. Remove certificates from both the clients and servers to preserve TLS.