Exams / DVA-C02 / Certificates and encryption in transit / Question 2
DVA-C02 practice question: Certificates and encryption in transit (2 of 2)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A team runs internal microservices that talk to each other over TLS using internal host names that are not on the public internet. They need X.509 certificates for these services, issued from their own certificate authority hierarchy without running an on-premises CA. Which AWS service should they use?
Choose one answer.
- AA. AWS Private CA
- BB. AWS Key Management Service
- CC. Amazon Cognito user pools
- DD. AWS Secrets Manager
Show the answer and explanation
Answer: A
- A. Right: Correct. AWS Private CA creates private root and subordinate CAs that issue certificates for internal TLS, users, devices and code signing.
- B. Wrong: KMS manages encryption keys. It does not run a certificate authority or issue X.509 certificates.
- C. Wrong: User pools authenticate application users and issue JWTs, not TLS certificates.
- D. Wrong: Secrets Manager stores and rotates secrets such as passwords. It does not issue certificates.
Explanation
AWS Private CA lets you build a private CA hierarchy and issue certificates for internal resources, such as TLS between services. Private certificates can also be requested through ACM and attached to ACM-integrated services. Public ACM certificates are for publicly trusted domain names.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.