SCS-C02 Question 398
Single answerAn organization is planning to deploy a web application on Amazon EC2 instances behind an Elastic Load Balancer (ELB). To meet compliance requirements, all traffic to the web application must be encrypted in transit. Additionally, the organization wants to minimize the operational overhead of managing SSL/TLS certificates. Which solution will meet these requirements?
- A
Use AWS Certificate Manager (ACM) to provision an SSL/TLS certificate and configure the Elastic Load Balancer to use it.
- B
Manually generate an SSL/TLS certificate using OpenSSL and configure the Elastic Load Balancer to use the certificate.
- C
Deploy a self-signed SSL/TLS certificate on each EC2 instance and terminate HTTPS at the EC2 instance level.
- D
Use AWS Key Management Service (KMS) to create a new key pair and configure the Elastic Load Balancer to use it.
Show answer and explanation
Correct answer: A
Explanation
To meet the compliance requirement of encrypting all traffic in transit and minimizing operational overhead, using AWS Certificate Manager (ACM) to provision and manage SSL/TLS certificates is the most efficient solution. ACM integrates seamlessly with Elastic Load Balancers, providing a managed, scalable approach to certificate lifecycle management without requiring manual intervention.
- A. Correct.
This is the correct option. AWS Certificate Manager (ACM) simplifies the provisioning and management of SSL/TLS certificates and can be directly integrated with AWS services like Elastic Load Balancers. This approach minimizes operational overhead and ensures encrypted traffic.
- B. Incorrect.
While this approach is technically feasible, it requires manual efforts to generate and manage the SSL/TLS certificates. This increases operational overhead and does not leverage AWS's native certificate management services.
- C. Incorrect.
Using self-signed certificates is not recommended for production environments due to trust issues and the operational challenges of managing certificates on each EC2 instance.
- D. Incorrect.
AWS Key Management Service (KMS) is not designed for managing SSL/TLS certificates. It is used for managing cryptographic keys and cannot be configured for use with Elastic Load Balancers.