DEA-C01 practice question 1 of 25

A company hosts its applications on Amazon EC2 instances. The company must use SSL/TLS connections that encrypt data in transit to communicate…

A company hosts its applications on Amazon EC2 instances. The company must use SSL/TLS connections that encrypt data in transit to communicate securely with AWS infrastructure that is managed by a customer. A data engineer needs to implement a solution to simplify the generation, distribution, and rotation of digital certificates. The solution must automatically renew and deploy SSL/TLS certificates. Which solution will meet these requirements with the LEAST operational overhead?

Answer options

A: Store self-managed certificates on the EC2 instances.

B: Use AWS Certificate Manager (ACM). Correct answer

C: Implement custom automation scripts in AWS Secrets Manager.

D: Use Amazon Elastic Container Service (Amazon ECS) Service Connect.

Correct Answer:

B. Use AWS Certificate Manager (ACM).

Explanation

AWS Certificate Manager (ACM) provisions public or private SSL/TLS certificates, automatically renews them, and deploys renewed certificates to ACM-integrated endpoints (ALB, NLB, CloudFront, API Gateway) without scripting or host-level operations, providing the lowest operational overhead.

Why Incorrect

A. Self-managed certificates require manual issuance, distribution, and rotation on every EC2 instance, increasing operational burden.
C. Secrets Manager rotates text-based secrets; it cannot issue or automatically renew X.509 SSL/TLS certificates.
D. ECS Service Connect offers service discovery and connectivity for containers; it does not manage SSL/TLS certificates.

References

1. AWS Certificate Manager User Guide – “About ACM” & “Managed Renewal” (docs.aws.amazon.com/acm/latest/userguide/acm-overview.html).

2. AWS Certificate Manager FAQs – “ACM automatically renews certificates” (https://aws.amazon.com/certificate-manager/faqs/).

3. AWS Secrets Manager User Guide – “Secrets managed are passwords and API keys, not certificates” (docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html).

4. Amazon ECS Service Connect – “Service Connect simplifies communication; certificate management not included” (docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect.html).

5. AWS Security Best Practices – “Use ACM to reduce certificate-handling overhead” (AWS Whitepaper V1, p.18).

Keep practicing

Take the free DEA-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test