DOP-C02 · Question #187
A company uses an Amazon API Gateway regional REST API to host its application API. The REST API has a custom domain. The REST API's default endpoint is deactivated. The company's internal teams consu
The correct answer is A. Use AWS Certificate Manager (ACM) to create a private certificate authority (CA). Provision a E. Upload the root private certificate authority (CA) certificate to an Amazon S3 bucket. Configure. Mutual TLS with API Gateway Explanation Options A and E are correct because mutual TLS (mTLS) with API Gateway requires a private Certificate Authority (CA) for internal use cases. You use AWS Certificate Manager (ACM) to create a private CA (Option A) to issue client certificate
Question
A company uses an Amazon API Gateway regional REST API to host its application API. The REST API has a custom domain. The REST API's default endpoint is deactivated. The company's internal teams consume the API. The company wants to use mutual TLS between the API and the internal teams as an additional layer of authentication. Which combination of steps will meet these requirements? (Choose two.)
Options
- AUse AWS Certificate Manager (ACM) to create a private certificate authority (CA). Provision a
- BProvision a client certificate that is signed by a public certificate authority (CA). Import the
- CUpload the provisioned client certificate to an Amazon S3 bucket. Configure the API Gateway
- DUpload the provisioned client certificate private key to an Amazon S3 bucket. Configure the API
- EUpload the root private certificate authority (CA) certificate to an Amazon S3 bucket. Configure
How the community answered
(30 responses)- A83% (25)
- B3% (1)
- C10% (3)
- D3% (1)
Explanation
Mutual TLS with API Gateway Explanation
Options A and E are correct because mutual TLS (mTLS) with API Gateway requires a private Certificate Authority (CA) for internal use cases. You use AWS Certificate Manager (ACM) to create a private CA (Option A) to issue client certificates trusted within your organization, and then you upload the root private CA certificate to an S3 bucket and reference it as the truststore in API Gateway (Option E) - this tells API Gateway which CA signatures to trust when clients present their certificates.
Option B is wrong because a public CA is unnecessary and inappropriate for internal team authentication; private CAs are purpose-built for internal/private communication. Option C is wrong because API Gateway's mTLS truststore requires the CA certificate (to verify client certificates), not the client certificate itself. Option D is wrong because uploading a private key to S3 is a security anti-pattern and not how API Gateway mTLS is configured - the truststore only needs the CA certificate, never private keys.
Memory Tip: Think of mTLS as a "bouncer with a guest list" - API Gateway (the bouncer) needs the CA's root certificate (the guest list) stored in S3 to verify who signed the client's certificate. ACM Private CA creates the list; S3 hosts it. Never share private keys!
Topics
Community Discussion
No community discussion yet for this question.