SOA-C02 · Question #556
A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new…
The correct answer is C. Request a new certificate by using AWS Certificate Manager (ACM) from the development. ACM certificates must reside in the same AWS account as the resources that use them (e.g., a load balancer or CloudFront distribution). Since the application runs in the development account, the certificate must be requested there - even though DNS validation requires adding a…
Question
A company uses a multi-account structure in the AWS Cloud. The company's environment includes a shared account for common resources. The environment also includes a development account for new application development. The company uses Amazon Route 53 for DNS management. The company manages all its Route 53 hosted zones from the shared account. A SysOps administrator needs to obtain a new SSL/TLS certificate for an application that is deployed in the development account. What must the SysOps administrator do to meet this requirement?
Options
- ACreate a new AWS Key Management Service (AWS KMS) key in the shared account.
- BRequest a new certificate by using AWS Certificate Manager (ACM) from the shared account.
- CRequest a new certificate by using AWS Certificate Manager (ACM) from the development
- DCreate a new AWS Key Management Service (AWS KMS) key in the development account.
How the community answered
(36 responses)- A6% (2)
- B11% (4)
- C81% (29)
- D3% (1)
Explanation
ACM certificates must reside in the same AWS account as the resources that use them (e.g., a load balancer or CloudFront distribution). Since the application runs in the development account, the certificate must be requested there - even though DNS validation requires adding a CNAME record to the Route 53 hosted zone in the shared account (which the admin can do manually or cross-account).
Why the distractors are wrong:
- A & D (KMS keys): KMS keys are for encrypting/decrypting data, not for obtaining SSL/TLS certificates - these are entirely the wrong service.
- B (ACM from shared account): An ACM certificate in the shared account cannot be attached to resources in the development account; ACM certificates are account-scoped and don't cross account boundaries.
Memory tip: Think "certificate follows the application." Wherever your workload lives, that's where you request the ACM certificate - DNS validation is just a proof step that can be satisfied regardless of which account owns the hosted zone.
Topics
Community Discussion
No community discussion yet for this question.