DOP-C02 Security and Compliance Practice Question
Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatic renewal of certificates.
Option C is correct because ACM automatically renews certificates that it issued and manages, as long as the certificate is in use and the domain validation remains valid, eliminating manual renewal overhead. Option D is correct because ACM certificates can be directly associated with Elastic Load Balancing (ALB/NLB) and Amazon CloudFront distributions, enabling seamless deployment of TLS termination without exporting private keys. Option A is not a listed benefit because ACM-issued public certificates cannot be exported or installed directly on EC2 instances; you must use services like ELB, CloudFront, or API Gateway. Option B is incorrect because ACM supports both wildcard and non-wildcard (single-domain and multi-domain/SAN) certificates. Option E is incorrect because ACM public certificates are free only for integrated AWS services, not for arbitrary AWS services or exportable use, and ACM Private CA certificates incur cost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ability to use the same certificate on multiple EC2 instances.
Why it's wrong here
AWS Certificate Manager does not expose the private key for ACM-issued certificates, so you cannot download or install them on an EC2 instance as you would with an externally generated certificate. The service is designed to streamline TLS/SSL for integrated AWS resources such as ALB, CloudFront, and API Gateway, not for direct use on compute instances. This option is incorrect because the inability to export the key makes 'same certificate on multiple EC2 instances' impossible rather than a benefit.
- ✗
Support for wildcard certificates only.
Why it's wrong here
ACM supports both wildcard certificates, such as *.example.com, and standard certificates for fully qualified domain names; neither is restricted to wildcards only. The claim is factually false, and it also mischaracterizes a feature—wildcard-only support would be a limitation, not a benefit. Because ACM offers flexibility for both multi-level domains and single hostnames, this option cannot be considered a correct answer.
- ✓
Automatic renewal of certificates.
Why this is correct
ACM automatically renews issued certificates when they are deployed on supported services, provided the domain validation remains valid, which spares engineers from manually tracking expiration dates. This automated lifecycle management is a key operational benefit because it prevents unexpected service interruptions caused by expired certificates. The renewal process works silently in the background, reissuing certificates before the current one expires, making it a primary reason organizations choose ACM.
- ✓
Integration with Elastic Load Balancing and Amazon CloudFront.
Why this is correct
ACM provides native, one-click provisioning of trusted TLS certificates to Elastic Load Balancing (both ALB and NLB) and Amazon CloudFront, eliminating the need to manually upload or manage certificate files on those services. This tight integration ensures that certificate updates, including renewals, are automatically deployed to the integrated resource without reconfiguration. The ease of associating ACM certificates to these edge and load-balancing services is a major operational benefit, especially in architectures that require secure listener configuration.
- ✗
Free certificates for use on any AWS service.
Why it's wrong here
ACM issues public certificates at no charge, but they can only be deployed on integrated AWS services such as Elastic Load Balancing, CloudFront and API Gateway; certificates cannot be exported for use on EC2 instances or on-premises servers. The claim of use on any AWS service overstates that integration scope. ACM's free public certificates are the correct answer when the endpoint is one of those integrated services.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.