DOP-C02 practice question: Encryption, KMS, ACM and Macie (2 of 2)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A university's student portal runs behind an Application Load Balancer, with its DNS name managed in Amazon Route 53 in the same account. The portal needs a public TLS certificate from AWS Certificate Manager for its domain, and browsers on student devices must trust it without any extra setup.
The certificate must renew automatically, so that no one has to track expiry dates as certificate lifetimes get shorter, and the request should not depend on an email message to a mailbox that may be unmonitored.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Request the certificate with email validation, sent to the domain's administrative contact address, and request a new certificate by hand each time the current one nears expiry.
BB. Generate a certificate with OpenSSL on an administrator's workstation, import it into ACM, and set a calendar reminder to import a new certificate before the old one expires.
CC. Create a self-signed certificate for the portal, and install it on the load balancer with a longer validity period, so that renewal is needed only every several years.
DD. Request the public certificate from ACM with DNS validation, and create the validation CNAME record in the Route 53 hosted zone, so that ACM renews the certificate automatically while the record remains.
ACM certificates validated by DNS can renew automatically while the validation CNAME record remains in the Route 53 hosted zone, and no mailbox is needed. Email validation depends on a mailbox, imported certificates need manual replacement, and self-signed certificates are not trusted by browsers.
Want more on Encryption, KMS, ACM and Macie? The 5 full-length practice sets have 10 more Encryption, KMS, ACM and Macie questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →