DOP-C02 Question 384
Select 2Your organization uses AWS Certificate Manager (ACM) to manage SSL/TLS certificates for multiple public-facing applications running on Amazon Elastic Load Balancers (ALBs). A recent security audit has mandated that all certificates must be renewed automatically to avoid downtime due to expired certificates. However, the security team also highlighted that critical systems must be notified well in advance before any certificates approach their expiration date. Which combination of actions should you take to meet these requirements?
- A
Use ACM to automatically renew certificates and attach them to the ALBs.
- B
Set up AWS Config rules to monitor ACM certificate expiration and trigger notifications.
- C
Enable Amazon EventBridge to publish an event when an ACM certificate is nearing expiration, and configure an SNS topic for email notifications.
- D
Manually track ACM certificate expiration dates and renew certificates before they expire.
- E
Use a Lambda function to periodically check for expiring certificates via the ACM API and send notifications.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements of automatic certificate renewal and proactive notifications, you can rely on native AWS services. ACM automatically renews eligible certificates for AWS resources like ALBs, eliminating the risk of downtime due to expired certificates. For notifications, Amazon EventBridge can detect expiring certificates and trigger an SNS topic to inform relevant stakeholders. This approach is efficient and leverages managed services, minimizing operational overhead.
- A. Correct.
ACM supports automatic renewal of eligible certificates (e.g., certificates issued by ACM for domains validated via DNS). ACM will automatically renew these certificates and deploy them to associated resources such as ALBs.
- B. Incorrect.
AWS Config is a powerful monitoring tool, but it does not natively provide rules specific to ACM certificate expiration or trigger notifications on expiring certificates.
- C. Correct.
Amazon EventBridge can generate events for ACM certificate expiration. By configuring an EventBridge rule and associating it with an SNS topic, administrators can receive proactive notifications about expiring certificates.
- D. Incorrect.
Manually tracking and renewing certificates is error-prone and does not align with the requirement for automation to prevent downtime.
- E. Incorrect.
While a Lambda function could be custom-built to check for expiring certificates, it introduces unnecessary complexity since ACM and EventBridge already provide native mechanisms for renewal and notifications.