Exams / DVA-C02 / Certificates and encryption in transit / Question 1
DVA-C02 practice question: Certificates and encryption in transit (1 of 2)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A developer is adding the custom domain api.example.com to an edge-optimised REST API that is deployed in the eu-west-2 Region. The developer requested a public certificate in AWS Certificate Manager (ACM) in eu-west-2 and it was issued, but the certificate is not offered when creating the custom domain name. The API must stay edge-optimised. What should the developer do?
Choose one answer.
- AA. Import the eu-west-2 certificate into AWS IAM and select it from there.
- BB. Request or import the certificate in ACM in the us-east-1 Region.
- CC. Request a private certificate from AWS Private CA in eu-west-2.
- DD. Wait for the certificate to replicate automatically to the API's CloudFront distribution.
Show the answer and explanation
Answer: B
- A. Wrong: There is no need for IAM server certificates. The fix is to have the ACM certificate in the right Region.
- B. Right: Correct. Edge-optimised custom domain names require the ACM certificate to be in US East (N. Virginia).
- C. Wrong: A private certificate is not trusted by public clients, and the Region would still be wrong for an edge-optimised domain.
- D. Wrong: ACM certificates are Regional and cannot be copied between Regions. Nothing replicates automatically.
Explanation
ACM certificates are Regional resources. Edge-optimised API Gateway domain names are served through CloudFront, so their certificate must be requested or imported in us-east-1. A Regional custom domain name instead needs the certificate in the same Region as the API.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.