ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Certificates and encryption in transit / Question 2

DVA-C03 practice question: Certificates and encryption in transit (2 of 2)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A healthcare software team runs microservices that call each other over TLS using internal host names such as claims.internal.corp, which cannot be resolved on the public internet.

The team needs X.509 certificates issued from its own private certificate authority hierarchy and does not want to operate CA servers itself.

Which service should the team use?

Choose one answer.

  1. A. AWS Private Certificate Authority, with certificates requested through AWS Certificate Manager or its API.
  2. B. AWS Certificate Manager public certificates, requested for each internal host name and validated through DNS or email.
  3. C. AWS Key Management Service asymmetric keys, with the team signing each certificate request by hand using a shared key.
  4. D. AWS Secrets Manager, storing self-signed certificates for each service and rotating them automatically every few months.
Show the answer and explanation

Answer: A

  • A. Right: Correct. AWS Private CA lets you create root and subordinate CAs and issue private X.509 certificates for internal TLS without running your own CA infrastructure. Certificates can be requested through ACM or the Private CA API. Learn more: What is AWS Private CA? (opens in a new tab)
  • B. Wrong: ACM public certificates are domain validated, so the requester must prove control of the name through public DNS or email. Internal-only names cannot pass that check. A private CA is the way to issue certificates for them. Learn more: ACM public certificate characteristics (opens in a new tab)
  • C. Wrong: KMS can hold a signing key, but it is not a certificate authority. It does not build the CA hierarchy, issue certificates or track revocation for you.
  • D. Wrong: Secrets Manager stores and rotates secrets, but it does not issue certificates from a CA. Self-signed certificates would not give the services a shared hierarchy to trust.

Explanation

AWS Private CA is the managed service for creating private CA hierarchies and issuing X.509 certificates for internal workloads, with no CA servers to run. ACM public certificates need publicly validated names, and KMS or Secrets Manager do not issue certificates.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Certificates and encryption in transitAll Certificates and encryption in transit questions

Want more on Certificates and encryption in transit? The 5 full-length practice sets have 9 more Certificates and encryption in transit questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets