SCS-C02 · Question #31
A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through…
The correct answer is C. Custom SSL certificate that is stored in AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct AWS-native service for provisioning, storing, and deploying custom SSL/TLS certificates for securing website communications with HTTPS.
Question
A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS. Which of the following is a valid option for storing SSL/TLS certificates?
Options
- ACustom SSL certificate that is stored in AWS Key Management Service (AWS KMS)
- BDefault SSL certificate that is stored in Amazon CloudFront
- CCustom SSL certificate that is stored in AWS Certificate Manager (ACM)
- DDefault SSL certificate that is stored in Amazon S3
How the community answered
(34 responses)- A3% (1)
- B3% (1)
- C88% (30)
- D6% (2)
Why each option
AWS Certificate Manager (ACM) is the correct AWS-native service for provisioning, storing, and deploying custom SSL/TLS certificates for securing website communications with HTTPS.
AWS KMS is a key management service for creating and controlling cryptographic keys used to encrypt data. It does not store or manage SSL/TLS certificates for web server authentication.
CloudFront provides a default SSL certificate only for *.cloudfront.net domain names. It cannot be used to secure a custom domain like example.com; a custom certificate from ACM or a third party is required for that.
ACM allows you to import third-party certificates or provision AWS-managed public certificates for custom domains like example.com. These certificates can be deployed directly to integrated services such as Application Load Balancers and Amazon CloudFront distributions, enabling HTTPS without managing certificate renewals manually.
Amazon S3 is an object storage service and does not function as a certificate store or provide SSL/TLS termination capabilities for serving HTTPS traffic to end users.
Concept tested: SSL/TLS certificate management with AWS Certificate Manager
Source: https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html
Community Discussion
No community discussion yet for this question.