SCS-C02 Question 475
Single answerYour company has a critical application hosted on Amazon EC2 instances in a VPC. The application requires encrypted communication and must also comply with a strict security policy that mandates the use of customer-managed encryption keys for all TLS traffic. Which solution BEST meets this requirement?
- A
Use AWS Certificate Manager (ACM) to automatically provision and manage TLS certificates for your EC2 instances.
- B
Use a third-party Certificate Authority (CA) to issue TLS certificates and manage them manually on the EC2 instances.
- C
Use AWS Certificate Manager Private Certificate Authority (ACM PCA) to create private certificates signed by a customer-managed root CA and deploy them on the EC2 instances.
- D
Enable TLS termination at an Application Load Balancer (ALB) and use AWS-managed certificates.
Show answer and explanation
Correct answer: C
Explanation
The requirement to use customer-managed encryption keys for all TLS traffic eliminates options that rely on AWS-managed keys, such as AWS Certificate Manager and ALB with AWS-managed certificates. The best solution is to use AWS Certificate Manager Private Certificate Authority (ACM PCA), as it enables you to create private certificates signed by a customer-managed root CA, ensuring compliance with the security policy while maintaining ease of management within the AWS ecosystem.
- A. Incorrect.
AWS Certificate Manager (ACM) simplifies certificate management but uses AWS-managed keys, which does not comply with the requirement for customer-managed encryption keys.
- B. Incorrect.
While a third-party CA allows you to manage your certificates, it adds complexity and manual overhead, making it a suboptimal choice compared to other AWS-native solutions.
- C. Correct.
AWS Certificate Manager Private Certificate Authority (ACM PCA) allows you to create private certificates using a customer-managed root CA, fulfilling the compliance requirement for customer-managed encryption keys while integrating seamlessly with AWS services.
- D. Incorrect.
Using an Application Load Balancer (ALB) with AWS-managed certificates does not meet the requirement for customer-managed encryption keys because the keys are managed by AWS.