Amazon Exam Amazon-DEA-C01 Topic 3 Question 8 Discussion

Actual exam question for Amazon's Amazon-DEA-C01 exam

Question #: 8
Topic #: 3

A company hosts its applications on Amazon EC2 instances. The company must use SSL/TLS connections that encrypt data in transit to communicate securely with AWS infrastructure that is managed by a customer.

A data engineer needs to implement a solution to simplify the generation, distribution, and rotation of digital certificates. The solution must automatically renew and deploy SSL/TLS certificates.

Which solution will meet these requirements with the LEAST operational overhead?

AStore self-managed certificates on the EC2 instances.

BUse AWS Certificate Manager (ACM).

CImplement custom automation scripts in AWS Secrets Manager.

DUse Amazon Elastic Container Service (Amazon ECS) Service Connect.

Show Suggested Answer

Suggested Answer: B

The best solution for managing SSL/TLS certificates on EC2 instances with minimal operational overhead is to use AWS Certificate Manager (ACM). ACM simplifies certificate management by automating the provisioning, renewal, and deployment of certificates.

AWS Certificate Manager (ACM):

ACM manages SSL/TLS certificates for EC2 and other AWS resources, including automatic certificate renewal. This reduces the need for manual management and avoids operational complexity.

ACM also integrates with other AWS services to simplify secure connections between AWS infrastructure and customer-managed environments.

Alternatives Considered:

A (Self-managed certificates): Managing certificates manually on EC2 instances increases operational overhead and lacks automatic renewal.

C (Secrets Manager automation): While Secrets Manager can store keys and certificates, it requires custom automation for rotation and does not handle SSL/TLS certificates directly.

D (ECS Service Connect): This is unrelated to SSL/TLS certificate management and would not address the operational need.

AWS Certificate Manager Documentation

by Thurman at Dec 06, 2024, 02:47 PM

Limited Time Offer

25%

Off

Get Premium Amazon-DEA-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lawanda

4 days ago

Haha, I bet the person who came up with option D was just trying to be fancy. 'Amazon Elastic Container Service (Amazon ECS) Service Connect' - that's a mouthful!

upvoted 0 times

...

Launa

8 days ago

I agree, B is the way to go. No need to reinvent the wheel when AWS has a service that handles this for you.

upvoted 0 times

...

Vivienne

17 days ago

Using ACM reduces operational overhead and ensures certificates are managed securely.

upvoted 0 times

...

Mona

18 days ago

Option B seems like the most straightforward solution. AWS Certificate Manager takes care of the hassle of managing certificates, and it's integrated with other AWS services.

upvoted 0 times