SAA-C03 practice question: Encryption at rest and in transit (1 of 2)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A small charity's donation website runs on Amazon EC2 instances behind an Application Load Balancer and is served over HTTP only.

Browsers now warn visitors that the site is not secure. The charity needs HTTPS with a certificate that browsers trust, it has no one to renew certificates by hand, and it cannot pay for anything extra.

What should a solutions architect do?

Choose one answer.

A. Buy a certificate from a commercial certificate authority, import it into AWS Certificate Manager, and attach it to a new HTTPS listener.
B. Request a public certificate in AWS Certificate Manager with DNS validation, and attach it to a new HTTPS listener on the load balancer.
C. Issue a private certificate from AWS Private CA through AWS Certificate Manager, and attach it to a new HTTPS listener on the load balancer.
D. Generate a self-signed certificate with OpenSSL on one instance, upload it to IAM, and attach it to a new HTTPS listener on the load balancer.

Show the answer and explanation

Answer: B

A. Wrong: Browsers would trust the certificate, but it costs money and ACM does not renew imported certificates. Someone would have to buy and re-import a new one before each expiry. A public certificate issued by ACM avoids both problems. Learn more: Managed certificate renewal in AWS Certificate Manager (opens in a new tab)
B. Right: Correct. Public certificates from ACM are trusted by all major browsers and cost nothing extra when used with Elastic Load Balancing. With DNS validation, ACM renews the certificate automatically while it is in use. Learn more: Create an HTTPS listener for your Application Load Balancer (opens in a new tab)
C. Wrong: Private certificates are not publicly trusted, so visitors' browsers would still show warnings, and AWS Private CA has its own charges. Private certificates are meant for internal traffic. A public ACM certificate fits a public website. Learn more: Types of certificates in AWS Certificate Manager (opens in a new tab)
D. Wrong: A self-signed certificate is free, but no browser trusts it, so visitors would see a security warning. It also has to be replaced by hand before it expires. A public ACM certificate is trusted and renews itself. Learn more: What is AWS Certificate Manager? (opens in a new tab)

Explanation

AWS Certificate Manager issues public TLS certificates at no extra charge for use with integrated services such as Elastic Load Balancing and CloudFront. They are trusted by browsers, and DNS-validated certificates in use are renewed automatically. Imported certificates are not renewed by ACM, and private or self-signed certificates are not publicly trusted.

SAA-C03 practice question: Encryption at rest and in transit (1 of 2)

Explanation

Study

Keep practicing