DVA-C02 Development with AWS Services Practice Question
A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API needs to support a custom domain name and an SSL/TLS certificate. Which AWS service should the developer use to manage the SSL/TLS certificate?
⚠ Common exam trap
It's easy for candidates to confuse AWS KMS or Secrets Manager with certificate management, but ACM is the only service that directly provisions and manages SSL/TLS certificates for use with AWS services like API Gateway and CloudFront.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) is the correct service for provisioning, managing, and deploying SSL/TLS certificates for use with AWS services like API Gateway. ACM integrates directly with API Gateway to automatically renew certificates and attach them to custom domain names, ensuring secure HTTPS connections without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (AWS KMS)
Why it's wrong here
AWS Key Management Service (AWS KMS) is designed for creating and managing cryptographic keys used for data encryption and digital signatures. It provides a highly available and scalable service for generating, storing, and controlling the use of encryption keys. However, KMS does not issue, store, or manage X.509 SSL/TLS certificates required for securing custom domain names with services like API Gateway, making it unsuitable for this purpose.
- ✓
AWS Certificate Manager (ACM)
Why this is correct
AWS Certificate Manager (ACM) is the dedicated service for provisioning, managing, and deploying SSL/TLS certificates for use with AWS services. It allows you to easily request public or private certificates, which are then automatically renewed and deployed to integrated services like API Gateway, CloudFront, and Elastic Load Balancers. This seamless integration and automated lifecycle management make ACM the correct and preferred choice for securing custom domains on API Gateway.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
AWS Identity and Access Management (IAM) is primarily used for managing access to AWS services and resources, defining users, groups, and roles. While IAM does have a legacy feature for uploading server certificates, this functionality is not recommended for modern AWS services like API Gateway. ACM offers superior integration, automated renewal, and a more streamlined process specifically designed for SSL/TLS certificate management, making IAM an outdated and less efficient option for this task.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is a service for securely storing and rotating sensitive information such as database credentials, API keys, and other application secrets. Its purpose is to help you manage the lifecycle of these secrets, including automatic rotation. However, Secrets Manager is not designed for the issuance, validation, or automatic renewal of SSL/TLS certificates, nor does it integrate with API Gateway for custom domain certificate deployment.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.