Question 1,036 of 724
DVA-C02 Security Practice Question
A developer is using AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for a website hosted on CloudFront. The certificate must be renewed automatically. What is the correct action?
⚠ Common exam trap
Candidates often assume ACM requires manual renewal or additional automation (like Lambda), but ACM's automatic renewal for DNS-validated certificates is a key managed feature tested in the DVA-C02 exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACM automatically renews the certificate if it uses DNS validation.
ACM automatically renews certificates that use DNS validation, provided the required DNS CNAME record remains in place. CloudFront supports ACM certificates in us-east-1, and ACM handles renewal without any manual intervention or additional infrastructure like Lambda functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer must configure a Lambda function to renew the certificate.
Why it's wrong here
AWS Certificate Manager (ACM) is designed to fully automate the renewal process for managed certificates. Developers do not need to configure custom solutions like Lambda functions or other scripts to handle certificate renewals. This automation significantly reduces operational overhead and the risk of certificate expiration outages for integrated AWS services.
- ✗
The certificate cannot be used with CloudFront; ACM certificates are only for ALB.
Why it's wrong here
This statement is incorrect because ACM certificates are fully compatible with Amazon CloudFront distributions, allowing secure HTTPS connections for content delivery. While ACM certificates are indeed used with Application Load Balancers (ALB), they are also essential for securing other AWS services, including API Gateway and Elastic Load Balancing (ELB) in general, not exclusively ALB.
- ✓
ACM automatically renews the certificate if it uses DNS validation.
Why this is correct
This statement is correct. AWS Certificate Manager (ACM) automatically attempts to renew certificates that were issued using DNS validation, typically starting 60 days before expiration. For this automatic renewal to succeed, the CNAME record created during the initial validation must remain in the DNS configuration, allowing ACM to re-validate domain ownership without any manual intervention from the developer.
- ✗
The developer must manually request a new certificate before expiration.
Why it's wrong here
This is incorrect for certificates managed by ACM, especially those validated via DNS. One of ACM's primary benefits is eliminating the need for manual certificate management. Developers are only required to manually request a new certificate if the original certificate was issued using email validation and the domain owner fails to respond to renewal emails, or if the certificate is not managed by ACM.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.