CLF-C02 Security and Compliance Practice Question
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses a custom domain name and requires HTTPS for all traffic. The security team provisions an SSL/TLS certificate using AWS Certificate Manager (ACM) and associates it with the ALB. Which of the following is an advantage of using ACM over manually managing certificates?
⚠ Common exam trap
Watch out — candidates often confuse ACM's automatic renewal with encryption capabilities or assume ACM certificates are portable, when in fact ACM only manages certificates for AWS services and does not provide encryption between the load balancer and backend instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACM automatically renews the certificate before it expires, and the renewed certificate is automatically applied to the associated load balancer.
AWS Certificate Manager (ACM) automatically renews SSL/TLS certificates before they expire, and the renewed certificate is seamlessly applied to the associated AWS resources, such as an Application Load Balancer (ALB). This eliminates the manual effort of tracking expiration dates, generating new certificates, and re-associating them, which is a key operational advantage over self-managed certificates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ACM automatically renews the certificate before it expires, and the renewed certificate is automatically applied to the associated load balancer.
Why this is correct
Correct. When DNS validation is configured, ACM automatically renews certificates before expiration and applies the renewed certificate to the associated AWS resources such as an ALB, eliminating the need for manual renewal and reducing the risk of certificate expiration.
- ✗
ACM encrypts the traffic between the ALB and the EC2 instances, ensuring end-to-end encryption.
Why it's wrong here
Incorrect. ACM provisions certificates for the ALB to terminate HTTPS connections from clients. Encryption between the ALB and backend instances is configured separately via the ALB listener and target group settings (e.g., using HTTPS or TCP with TLS). ACM does not manage backend encryption.
When this WOULD be correct
In a scenario where the question asks about a feature that provides encryption between the ALB and EC2 instances (e.g., using ACM with mutual TLS or integrating with AWS Private CA), but ACM alone does not do this.
- ✗
ACM provides a certificate that can be exported and installed on any on-premises server for free.
Why it's wrong here
Incorrect. ACM certificates cannot be exported for general use outside of AWS. They are intended for use only with integrated AWS services (e.g., ALB, CloudFront, API Gateway). Exporting is not supported, so they cannot be installed on on-premises servers.
When this WOULD be correct
A question might ask: 'Which AWS service provides free public SSL/TLS certificates that can be used with AWS services like CloudFront and ALB?' In that context, ACM provides certificates at no additional cost, making it a correct answer.
- ✗
ACM requires the company to store the private key in a secure location outside of AWS.
Why it's wrong here
Incorrect. ACM manages the private key securely within AWS and does not expose it to customers. Customers do not have to generate, store, or rotate private keys; ACM handles key management as part of the service.
When this WOULD be correct
In a scenario where a company needs to use a certificate on an on-premises server or a non-ACM-integrated service, and the certificate must be obtained from a public CA, the company would need to generate a private key and store it securely outside AWS, often in a hardware security module (HSM) or secure vault.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓ACM automatically renews the certificate before it expires, and the renewed certificate is automatically applied to the associated load balancer.Correct answer▾
Why this is correct
Correct. When DNS validation is configured, ACM automatically renews certificates before expiration and applies the renewed certificate to the associated AWS resources such as an ALB, eliminating the need for manual renewal and reducing the risk of certificate expiration.
✗ACM encrypts the traffic between the ALB and the EC2 instances, ensuring end-to-end encryption.Wrong answer — click to see why▾
Why this is wrong here
ACM does not encrypt traffic between the ALB and EC2 instances; it only offloads SSL/TLS termination at the ALB. End-to-end encryption requires configuring HTTPS on the instances themselves.
★ When this WOULD be the correct answer
In a scenario where the question asks about a feature that provides encryption between the ALB and EC2 instances (e.g., using ACM with mutual TLS or integrating with AWS Private CA), but ACM alone does not do this.
Why candidates choose this
Candidates may confuse SSL/TLS termination at the load balancer with end-to-end encryption, assuming ACM handles all encryption automatically.
✗ACM provides a certificate that can be exported and installed on any on-premises server for free.Wrong answer — click to see why▾
Why this is wrong here
ACM certificates cannot be exported for use on on-premises servers; they are tied to AWS services and cannot be downloaded or installed externally.
★ When this WOULD be the correct answer
A question might ask: 'Which AWS service provides free public SSL/TLS certificates that can be used with AWS services like CloudFront and ALB?' In that context, ACM provides certificates at no additional cost, making it a correct answer.
Why candidates choose this
Candidates may mistakenly believe that ACM certificates are free and exportable, similar to Let's Encrypt, or they may confuse ACM with a general-purpose certificate authority that allows certificate export.
✗ACM requires the company to store the private key in a secure location outside of AWS.Wrong answer — click to see why▾
Why this is wrong here
ACM does not require storing the private key outside AWS; in fact, ACM manages the private key securely within AWS and does not allow export of private keys for certificates used with ACM-integrated services like ALB.
★ When this WOULD be the correct answer
In a scenario where a company needs to use a certificate on an on-premises server or a non-ACM-integrated service, and the certificate must be obtained from a public CA, the company would need to generate a private key and store it securely outside AWS, often in a hardware security module (HSM) or secure vault.
Why candidates choose this
Candidates may think that because ACM handles certificate issuance, the private key must be stored elsewhere for security, not realizing that ACM securely manages the private key within its service and does not expose it to the customer.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.