Question 1,093 of 724
DVA-C02 Security Practice Question
A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?
⚠ Common exam trap
Candidates often confuse AWS KMS (used for encryption keys for data at rest) with SSL/TLS certificate management for data in transit, leading them to select KMS instead of ACM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS KMS
Why it's wrong here
AWS Key Management Service (KMS) is primarily designed for creating, storing, and managing cryptographic keys, enabling encryption and decryption operations for data at rest and in transit. While certificates rely on cryptographic keys, KMS itself does not provision, renew, or deploy SSL/TLS certificates for web applications. Its focus is on key lifecycle management and cryptographic primitives, not the automated certificate lifecycle.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is a service for securely storing, managing, and rotating sensitive information such as database credentials, API keys, and other configuration secrets. Although a certificate's private key could technically be stored as a secret, Secrets Manager does not automate the issuance, validation, or renewal of SSL/TLS certificates. It lacks the capabilities to interact with Certificate Authorities or deploy certificates to web application endpoints.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM provides dedicated, FIPS 140-2 Level 3 validated hardware security modules (HSMs) in the AWS cloud for robust cryptographic key storage and operations. It is ideal for highly regulated workloads requiring strong key control and compliance. However, CloudHSM is a key management solution, not a certificate authority or a service for provisioning and managing the lifecycle of SSL/TLS certificates for web applications.
- ✓
AWS Certificate Manager (ACM)
Why this is correct
AWS Certificate Manager (ACM) is the correct service for encrypting a web application because it fully automates the provisioning, management, and deployment of public and private SSL/TLS certificates. ACM handles the complex processes of certificate issuance, renewal, and binding to integrated AWS services like Elastic Load Balancers, CloudFront distributions, and API Gateways. This ensures secure, encrypted communication for web applications without manual intervention, simplifying certificate lifecycle management significantly.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.