DVA-C02 Security Practice Question
A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?
⚠ Common exam trap
Candidates often confuse AWS KMS (used for encryption keys for data at rest) with SSL/TLS certificate management for data in transit, leading them to select KMS instead of ACM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS KMS
Why it's wrong here
AWS Key Management Service (KMS) is primarily designed for creating, storing, and managing cryptographic keys, enabling encryption and decryption operations for data at rest and in transit. While certificates rely on cryptographic keys, KMS itself does not provision, renew, or deploy SSL/TLS certificates for web applications. Its focus is on key lifecycle management and cryptographic primitives, not the automated certificate lifecycle.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is a service for securely storing, managing, and rotating sensitive information such as database credentials, API keys, and other configuration secrets. Although a certificate's private key could technically be stored as a secret, Secrets Manager does not automate the issuance, validation, or renewal of SSL/TLS certificates. It lacks the capabilities to interact with Certificate Authorities or deploy certificates to web application endpoints.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM provides dedicated, FIPS 140-2 Level 3 validated hardware security modules (HSMs) in the AWS cloud for robust cryptographic key storage and operations. It is ideal for highly regulated workloads requiring strong key control and compliance. However, CloudHSM is a key management solution, not a certificate authority or a service for provisioning and managing the lifecycle of SSL/TLS certificates for web applications.
- ✓
AWS Certificate Manager (ACM)
Why this is correct
AWS Certificate Manager (ACM) is the correct service for encrypting a web application because it fully automates the provisioning, management, and deployment of public and private SSL/TLS certificates. ACM handles the complex processes of certificate issuance, renewal, and binding to integrated AWS services like Elastic Load Balancers, CloudFront distributions, and API Gateways. This ensures secure, encrypted communication for web applications without manual intervention, simplifying certificate lifecycle management significantly.
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.