AWS Certificate Manager: Automate SSL/TLS Certificate Renewal
A company hosts a web application behind an Application Load Balancer (ALB) in AWS. The application must comply with a security policy requiring TLS encryption for all traffic between users and the ALB. The company wants to automate the renewal of TLS certificates and avoid manual certificate management. Which AWS service should the company use to provision and automatically renew the certificates?
Quick Answer
The answer is AWS Certificate Manager (ACM). ACM is the correct choice because it integrates directly with Application Load Balancers to provision and automatically renew SSL/TLS certificates, handling the entire certificate lifecycle without any manual intervention. This automation ensures continuous compliance with security policies requiring TLS encryption for all traffic between users and the ALB, as ACM automatically renews certificates before they expire. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of managed services that reduce operational overhead—a core cloud concept. A common trap is confusing ACM with third-party certificate authorities or manual uploads to IAM, but remember that ACM is the only service that provides fully automated renewal when attached to supported resources like ALBs. Memory tip: think “ACM Automates Certificate Management”—the name itself tells you it handles the renewal for you.
⚠ Common exam trap
Test-takers frequently confuse AWS Certificate Manager with AWS Secrets Manager or KMS, thinking any 'management' service can handle certificate renewal, but only ACM is purpose-built for provisioning and automatic renewal of TLS certificates for AWS services like ALB, CloudFront, and API Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) is the correct service because it integrates directly with Application Load Balancers to provision and automatically renew TLS certificates, eliminating manual certificate management. ACM handles the entire certificate lifecycle, including renewal, which is essential for maintaining TLS encryption compliance without operational overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Certificate Manager (ACM)
Why this is correct
Correct. ACM is the AWS service designed to provision, manage, and automatically renew SSL/TLS certificates for use with AWS services like ALB, CloudFront, and API Gateway.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
Incorrect. KMS manages encryption keys (symmetric and asymmetric) used for encrypting data at rest or in transit, but it does not manage X.509 SSL/TLS certificates or integrate with ALB for HTTPS listeners.
When this WOULD be correct
A question asks which service to use for managing encryption keys used to encrypt data at rest in S3 or EBS, or for envelope encryption in a custom application, requiring automatic key rotation.
- ✗
AWS Secrets Manager
Why it's wrong here
Incorrect. Secrets Manager is used to rotate and manage secrets such as database credentials and API keys. It is not designed to manage SSL/TLS certificates or provide automatic certificate renewal.
When this WOULD be correct
A company needs to store and automatically rotate database credentials or API keys for an application running on EC2. The question would specify that the requirement is to securely manage and rotate secrets, not TLS certificates.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
Incorrect. IAM can be used to upload server certificates for use with Elastic Load Balancers, but this requires manual certificate upload and renewal. IAM does not automate certificate renewal, making it unsuitable for this requirement.
When this WOULD be correct
IAM would be correct in a question about controlling access to AWS resources, such as creating a role that grants an EC2 instance permission to access an S3 bucket, or managing user permissions to perform specific actions in AWS.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Certificate Manager (ACM)Correct answer▾
Why this is correct
Correct. ACM is the AWS service designed to provision, manage, and automatically renew SSL/TLS certificates for use with AWS services like ALB, CloudFront, and API Gateway.
✗AWS Key Management Service (KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is used for creating and managing encryption keys, not for provisioning or automatically renewing TLS certificates for use with an ALB.
★ When this WOULD be the correct answer
A question asks which service to use for managing encryption keys used to encrypt data at rest in S3 or EBS, or for envelope encryption in a custom application, requiring automatic key rotation.
Why candidates choose this
Candidates may confuse TLS certificate management with key management, as both involve cryptography and encryption, leading them to select KMS instead of ACM.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed to manage secrets like database credentials and API keys, not TLS certificates. It does not provide automated certificate renewal or integration with AWS Certificate Manager for provisioning certificates on an ALB.
★ When this WOULD be the correct answer
A company needs to store and automatically rotate database credentials or API keys for an application running on EC2. The question would specify that the requirement is to securely manage and rotate secrets, not TLS certificates.
Why candidates choose this
Candidates may confuse Secrets Manager with ACM because both involve 'secrets' and 'certificates' are often considered secrets. The word 'automate' in the question might lead them to think of Secrets Manager's rotation feature.
✗AWS Identity and Access Management (IAM)Wrong answer — click to see why▾
Why this is wrong here
IAM is used for managing users, groups, roles, and permissions, not for provisioning or automatically renewing TLS certificates. It cannot issue or manage certificates for use with an ALB.
★ When this WOULD be the correct answer
IAM would be correct in a question about controlling access to AWS resources, such as creating a role that grants an EC2 instance permission to access an S3 bucket, or managing user permissions to perform specific actions in AWS.
Why candidates choose this
Candidates may confuse IAM's role in managing security credentials (like access keys) with certificate management, or assume IAM handles all security-related tasks in AWS.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs a web application behind an Application Load Balancer (ALB) in a VPC. The application must comply with a security standard that requires encryption in transit for all web traffic. The company needs a service to centrally manage SSL/TLS certificates, automatically renew them, and deploy them to the ALB without manual intervention. Which AWS service should the company use to meet these requirements?
medium- ✓ A.AWS Certificate Manager (ACM)
- B.AWS Key Management Service (AWS KMS)
- C.AWS Secrets Manager
- D.AWS Identity and Access Management (IAM)
Why A: AWS Certificate Manager (ACM) is the correct service because it provides centralized management of SSL/TLS certificates, supports automatic renewal for certificates issued by ACM, and can seamlessly deploy these certificates to an Application Load Balancer (ALB) without any manual intervention. This directly meets the requirement for encryption in transit and compliance with the security standard.
Variation 2. A company runs a web application on an Application Load Balancer (ALB) in the us-east-1 Region. The application serves HTTPS traffic. The company uses a third-party certificate authority to issue SSL/TLS certificates, but these certificates expire every year and require manual renewal. The company wants to use a managed AWS service to automatically provision, renew, and manage the SSL/TLS certificates for the ALB at no additional cost (no extra charge beyond the ALB usage). Which AWS service should the company use?
medium- A.AWS Key Management Service (AWS KMS)
- B.AWS WAF
- ✓ C.AWS Certificate Manager (ACM)
- D.AWS Secrets Manager
Why C: AWS Certificate Manager (ACM) is the correct service because it can provision, manage, and automatically renew public SSL/TLS certificates for use with an Application Load Balancer at no additional cost. ACM integrates directly with ALB to handle certificate deployment and renewal, eliminating the need for manual renewal of third-party certificates. The service is free for public certificates used with supported AWS services like ALB, CloudFront, and API Gateway.
Variation 3. A company wants to enable HTTPS on their Application Load Balancer using an SSL/TLS certificate. They want a managed service that provisions, renews, and deploys the certificate automatically at no cost for certificates used with integrated AWS services. Which AWS service provides this?
easy- A.AWS KMS
- B.AWS Secrets Manager
- ✓ C.AWS Certificate Manager
- D.AWS IAM
Why C: AWS Certificate Manager (ACM) is the correct service because it is a managed service that provisions, renews, and deploys SSL/TLS certificates automatically at no additional cost when used with integrated AWS services like Application Load Balancers. ACM handles the entire certificate lifecycle, including automatic renewal before expiration, and integrates natively with ALB to enable HTTPS without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.