CLF-C02 Cloud Technology and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS KMS

  Why it's wrong here

  AWS Key Management Service (KMS) is a managed service focused on creating, storing, and rotating symmetric and asymmetric encryption keys used for data encryption at rest. KMS integrates with AWS services for envelope encryption and cryptographic signing, but it does not participate in the public-key infrastructure (PKI) workflow of validating domain ownership or issuing X.509 certificates. As such, KMS has no capability to provision or renew SSL/TLS certificates for web servers, and it is not the correct service for this use case.

• ✓

  AWS Certificate Manager (ACM)

  Why this is correct

  AWS Certificate Manager (ACM) is the correct choice because it is a fully managed service that provisions and renews SSL/TLS certificates for AWS resources such as Application Load Balancers, CloudFront distributions, and API Gateway. ACM handles the entire certificate lifecycle, including domain validation, certificate issuance, and automatic renewal before expiration. There is no need to purchase certificates, submit CSRs, or manually track renewal dates, as ACM automates these steps at no additional cost.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM is a dedicated hardware security module (HSM) service that provides tamper-resistant hardware for generating and storing cryptographic keys, including the private keys associated with SSL/TLS certificates. While CloudHSM can securely store a certificate's private key and perform signing operations, it does not provision, issue, or renew SSL/TLS certificates. It lacks the PKI lifecycle features—such as domain validation and automated renewal—that ACM provides, so it addresses key storage, not certificate management.

• ✗

  AWS IAM

  Why it's wrong here

  AWS Identity and Access Management (IAM) is designed to manage users, roles, policies, and permissions for controlling access to AWS services. Although IAM offers the ability to upload a server certificate for use with Elastic Load Balancing (ELB) through its legacy Server Certificate API, this is a manual, static upload that requires the customer to obtain and renew the certificate from an external CA. IAM does not perform domain validation, certificate issuance, or automatic renewal, making it unsuitable for the automated SSL/TLS certificate lifecycle management described in the question.

Go deeper

Related to this question