CLF-C02 Security and Compliance Practice Question
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to serve traffic over HTTPS to encrypt data in transit between clients and the ALB. The security team requires that the SSL/TLS certificate be automatically renewed before expiration and that AWS manage the entire certificate lifecycle. The company does not want to manually upload or manage private keys. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse AWS Secrets Manager or KMS with certificate management, but neither service handles SSL/TLS certificate issuance or automatic renewal for load balancers; ACM is the only service that provides fully managed certificate lifecycle for ALB HTTPS termination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) is the correct choice because it integrates directly with Application Load Balancers to provision, deploy, and automatically renew SSL/TLS certificates. ACM manages the entire certificate lifecycle, including private key generation and storage, without requiring manual intervention. This meets the security team's requirement for automatic renewal and AWS-managed certificate lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Certificate Manager (ACM)
Why this is correct
ACM is the correct choice. It automates the provisioning, deployment, and renewal of SSL/TLS certificates for use with AWS services such as ALB, CloudFront, and API Gateway. ACM handles the full certificate lifecycle and keeps private keys secure.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager is designed to securely store and rotate secrets such as database credentials, API keys, and other sensitive information. It does not manage SSL/TLS certificates for use with load balancers and does not integrate directly with ALB for HTTPS termination.
When this WOULD be correct
A company needs to store and automatically rotate a database password or API key used by an application running on EC2. The requirement is to securely manage secrets with automatic rotation, not to handle SSL/TLS certificates.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
IAM allows you to upload server certificates for use with ALB and other services, but it does not provide automatic renewal. You must manually upload a new certificate before expiration, which does not meet the requirement for automated lifecycle management.
When this WOULD be correct
A company needs to securely store and rotate database credentials or API keys for an application running on EC2, and wants to automate credential rotation without managing secrets manually. In that scenario, AWS Secrets Manager would be the correct answer.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS KMS is a cryptography service that creates, manages, and rotates customer master keys (CMKs) and data keys used to encrypt data at rest in services like S3, EBS, and RDS. It does not issue, validate, or renew SSL/TLS certificates, and an Application Load Balancer cannot reference a KMS key to terminate HTTPS traffic. While KMS can encrypt the private key of a certificate if you store it manually, that does not provide automated provisioning or renewal, so it fails the requirement for a managed certificate lifecycle.
When this WOULD be correct
A company needs to encrypt data stored in an S3 bucket using a customer-managed key and wants to control key rotation and access policies. AWS KMS would be the correct service to create and manage the CMK.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Certificate Manager (ACM)Correct answer▾
Why this is correct
ACM is the correct choice. It automates the provisioning, deployment, and renewal of SSL/TLS certificates for use with AWS services such as ALB, CloudFront, and API Gateway. ACM handles the full certificate lifecycle and keeps private keys secure.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed to securely store and rotate secrets like database credentials and API keys, not to manage SSL/TLS certificates for HTTPS termination. It does not integrate with ALB to automatically deploy and renew certificates.
★ When this WOULD be the correct answer
A company needs to store and automatically rotate a database password or API key used by an application running on EC2. The requirement is to securely manage secrets with automatic rotation, not to handle SSL/TLS certificates.
Why candidates choose this
Candidates may confuse Secrets Manager's automatic rotation feature with certificate renewal, assuming it can manage SSL/TLS certificates similarly, but ACM is the dedicated service for certificate lifecycle management.
✗AWS Identity and Access Management (IAM)Wrong answer — click to see why▾
Why this is wrong here
IAM is used for managing users, groups, roles, and permissions, not for SSL/TLS certificate lifecycle management or automatic renewal. ACM is the service designed for provisioning, managing, and deploying SSL/TLS certificates.
★ When this WOULD be the correct answer
A company needs to securely store and rotate database credentials or API keys for an application running on EC2, and wants to automate credential rotation without managing secrets manually. In that scenario, AWS Secrets Manager would be the correct answer.
Why candidates choose this
Candidates may confuse IAM's role in managing permissions for certificate operations (like uploading certificates via IAM) with the actual certificate lifecycle management service, or think IAM can handle certificates because it supports server certificates for some AWS services.
✗AWS Key Management Service (KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is used to create and manage encryption keys for data at rest, not for SSL/TLS certificate lifecycle management. It does not provide certificate issuance, renewal, or deployment to ALBs.
★ When this WOULD be the correct answer
A company needs to encrypt data stored in an S3 bucket using a customer-managed key and wants to control key rotation and access policies. AWS KMS would be the correct service to create and manage the CMK.
Why candidates choose this
Candidates may confuse KMS with ACM because both involve encryption and 'key management,' but KMS handles symmetric encryption keys for data at rest, not public-key certificates for TLS.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses a custom domain name and requires HTTPS for all traffic. The security team provisions an SSL/TLS certificate using AWS Certificate Manager (ACM) and associates it with the ALB. Which of the following is an advantage of using ACM over manually managing certificates?
medium- ✓ A.ACM automatically renews the certificate before it expires, and the renewed certificate is automatically applied to the associated load balancer.
- B.ACM encrypts the traffic between the ALB and the EC2 instances, ensuring end-to-end encryption.
- C.ACM provides a certificate that can be exported and installed on any on-premises server for free.
- D.ACM requires the company to store the private key in a secure location outside of AWS.
Why A: AWS Certificate Manager (ACM) automatically renews SSL/TLS certificates before they expire, and the renewed certificate is seamlessly applied to the associated AWS resources, such as an Application Load Balancer (ALB). This eliminates the manual effort of tracking expiration dates, generating new certificates, and re-associating them, which is a key operational advantage over self-managed certificates.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.