DVA-C02 · Question #778
A company is deploying an Amazon CloudFront distribution in front of an existing web application. Application Load Balancer (ALB) in the eu-west-1 Region. The distribution uses the public DNS name…
The correct answer is A. Request a public certificate from AWS Certificate Manager (ACM) for www.example.com in the us-east-1 Region. Associate the certificate with the CloudFront distribution settings for custom domains. D. Update the DNS entry for the www.example.com zone in Route 53 to be an Alias A record to the public DNS name of the CloudFront distribution. CloudFront requires SSL/TLS certificates to be provisioned in ACM in us-east-1 (N. Virginia) regardless of where the origin or distribution is located - this is a hard AWS requirement for CloudFront custom domain certificates. Option A satisfies this by requesting the public…
Question
A company is deploying an Amazon CloudFront distribution in front of an existing web application. Application Load Balancer (ALB) in the eu-west-1 Region. The distribution uses the public DNS name of the ALB as its origin. The company uses an Amazon Route 53 hosted zone for the domain. A developer must ensure that all web traffic is encrypted. The developer must complete the CloudFront deployment for the application. Which combination of steps will meet these requirements? (Choose two.) us-east-1 Region. Associate the certificate with the CloudFront distribution settings for custom domains. west-1. Associate the certificate with the CloudFront distribution settings for custom domains. into AWS Certificate Manager (ACM) in the us-east-1 Region. Associate the certificate with the CloudFront distribution settings for custom domains. public DNS name of the Cloud Front distribution. points to the public DNS name of the ALB.
Options
- ARequest a public certificate from AWS Certificate Manager (ACM) for www.example.com in the us-east-1 Region. Associate the certificate with the CloudFront distribution settings for custom domains.
- BRequest a public certificate from AWS Certificate Manager (ACM) for www.example.com in eu-west-1. Associate the certificate with the CloudFront distribution settings for custom domains.
- CRequest a private certificate from AWS Private CA for www.example.com. Import the certificate into AWS Certificate Manager (ACM) in the us-east-1 Region. Associate the certificate with the CloudFront distribution settings for custom domains.
- DUpdate the DNS entry for the www.example.com zone in Route 53 to be an Alias A record to the public DNS name of the CloudFront distribution.
- EUpdate the DNS entry for the www.example.com zone in Route 53 to be a CNAME record that points to the public DNS name of the ALB.
How the community answered
(33 responses)- A82% (27)
- B6% (2)
- C9% (3)
- E3% (1)
Explanation
CloudFront requires SSL/TLS certificates to be provisioned in ACM in us-east-1 (N. Virginia) regardless of where the origin or distribution is located - this is a hard AWS requirement for CloudFront custom domain certificates. Option A satisfies this by requesting the public certificate in us-east-1 and associating it with the CloudFront distribution. Option D correctly routes user traffic through CloudFront by pointing the Route 53 DNS entry to the CloudFront distribution using an Alias A record, ensuring all traffic is encrypted end-to-end via CloudFront.
Topics
Community Discussion
No community discussion yet for this question.