A company is using AWS Certificate Manager (ACM) to manage public SSL/TLS certificates. A SysOps administrator needs to send an email notification when a certificate has less than 14 days until…

Question

Options

• ACreate an Amazon CloudWatch custom metric to monitor certificate expiration for all ACM
• BCreate an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to
• CCreate an Amazon CloudWatch dashboard that displays the DaysToExpiry metric for all ACM
• DCreate an Amazon EventBridge rule that has an event source of aws.acm. Configure the rule to

• A
  7% (3)
• B
  71% (30)
• C
  17% (7)
• D
  5% (2)

Explanation

Option B is correct because ACM natively emits EventBridge events (ACM Certificate Approaching Expiration) at 45, 30, 15, and 7 days before expiry - meaning no custom metric or monitoring logic needs to be built. You simply create an EventBridge rule matching that ACM event, filter for the ≤14-day threshold, and set the target to an SNS topic that sends email - a fully managed, serverless pipeline with zero ongoing maintenance.

Why the distractors fail:

• A - Creating a custom CloudWatch metric requires writing code (likely a Lambda) to query ACM and publish data points, adding significant operational overhead.
• C - A CloudWatch dashboard only displays data visually; it cannot trigger notifications on its own and requires someone to actively watch it.
• D - Also uses EventBridge with aws.acm, but the configuration described (likely targeting Lambda or a more complex pipeline) introduces unnecessary extra components compared to the direct EventBridge → SNS approach in B.

Memory tip: Think "ACM → EventBridge → SNS" as the native AWS alarm chain for certificate expiry. Whenever a question asks for least overhead with managed services, look for the solution that uses built-in event emission rather than custom polling or metrics - AWS already publishes the ACM Certificate Approaching Expiration event for you.

No community discussion yet for this question.