DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Certificate Manager (ACM)

  Why this is correct

  AWS Certificate Manager (ACM) is the dedicated AWS service for provisioning, managing, and deploying SSL/TLS certificates, including those required for HTTPS on web applications. It integrates seamlessly with services like Application Load Balancer (ALB), allowing you to easily attach certificates to secure traffic. ACM handles the entire certificate lifecycle, including automatic renewal, which significantly reduces the operational overhead of manual certificate management and ensures continuous secure communication between clients and the load balancer.

• ✗

  AWS Key Management Service (KMS)

  Why it's wrong here

  AWS Key Management Service (KMS) is a managed service primarily designed for creating and controlling encryption keys used to encrypt data at rest across various AWS services and within applications. While it deals with cryptographic keys, its purpose is not to provision or manage public SSL/TLS certificates for securing data in transit over HTTPS. KMS keys are typically symmetric or asymmetric keys used for encryption and decryption operations, not for establishing trust via X.509 certificates presented by a web server.

• ✗

  AWS Secrets Manager

  Why it's wrong here

  AWS Secrets Manager is a service for securely storing, managing, and rotating sensitive credentials such as database passwords, API keys, and other application secrets. While it can store arbitrary text, its primary design is for secrets that require rotation and fine-grained access control, not for the public-facing SSL/TLS certificates that establish identity and encryption for web traffic. Certificates, with their public/private key pairs and trust chain, are managed by services specifically designed for their lifecycle and public trust.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  AWS Identity and Access Management (IAM) is fundamental for securely controlling access to AWS services and resources by managing users, groups, roles, and their associated permissions. While IAM can store server certificates for services like CloudFront or Classic Load Balancer, it does not provide the full lifecycle management, automatic renewal, or domain validation capabilities that are essential for modern SSL/TLS certificate operations. Its core function is authorization and authentication, not certificate provisioning or automated renewal for web applications.