DOP-C02 Question 383
Single answerYou are managing an e-commerce application hosted on AWS with a load balancer distributing traffic to multiple EC2 instances. The application requires secure communication between clients and the load balancer using HTTPS. Additionally, you need to ensure that the certificates are automatically renewed without manual intervention. Which solution should you implement to achieve these requirements?
- A
Use AWS Certificate Manager (ACM) to provision and attach an SSL/TLS certificate to the load balancer
- B
Manually generate an SSL/TLS certificate using OpenSSL and upload it to the load balancer
- C
Purchase an SSL/TLS certificate from a third-party Certificate Authority (CA) and upload it to AWS Secrets Manager
- D
Use an EC2 instance to host a self-signed certificate and configure the load balancer to reference it
Show answer and explanation
Correct answer: A
Explanation
Using AWS Certificate Manager (ACM) is the best solution for managing SSL/TLS certificates in AWS. It simplifies certificate provisioning, deployment, and renewal, ensuring your application remains secure and operational without manual intervention. ACM integrates seamlessly with AWS services like Elastic Load Balancing, optimizing operations and reducing administrative tasks. Other options involve manual processes or are unsuitable for production-grade security.
- A. Correct.
This is the correct option. AWS Certificate Manager (ACM) provides a simple way to provision, manage, and deploy SSL/TLS certificates, automating the renewal process and integrating directly with AWS services like load balancers.
- B. Incorrect.
Although manually generating a certificate with OpenSSL is possible, it requires significant manual effort for provisioning, uploading, and renewing, which is not ideal for production environments.
- C. Incorrect.
AWS Secrets Manager is not designed for managing SSL/TLS certificates for load balancers. Additionally, purchasing a certificate from a third-party CA does not automate the renewal process, leading to potential downtime if certificates expire.
- D. Incorrect.
Using a self-signed certificate is not recommended for production environments because it is not trusted by clients, and hosting it on an EC2 instance adds unnecessary complexity and maintenance overhead.