DOP-C02 Security and Compliance Practice Question
Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatic renewal of certificates.
ACM automatically renews certificates before expiry, reducing manual overhead. It integrates with AWS services like ALB and CloudFront for easy deployment. ACM can export certificates for use on EC2 instances, but that is not a primary benefit; the main benefits are automatic renewal and integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ability to use the same certificate on multiple EC2 instances.
Why it's wrong here
AWS Certificate Manager does not expose the private key for ACM-issued certificates, so you cannot download or install them on an EC2 instance as you would with an externally generated certificate. The service is designed to streamline TLS/SSL for integrated AWS resources such as ALB, CloudFront, and API Gateway, not for direct use on compute instances. This option is incorrect because the inability to export the key makes 'same certificate on multiple EC2 instances' impossible rather than a benefit.
- ✗
Support for wildcard certificates only.
Why it's wrong here
ACM supports both wildcard certificates, such as *.example.com, and standard certificates for fully qualified domain names; neither is restricted to wildcards only. The claim is factually false, and it also mischaracterizes a feature—wildcard-only support would be a limitation, not a benefit. Because ACM offers flexibility for both multi-level domains and single hostnames, this option cannot be considered a correct answer.
- ✓
Automatic renewal of certificates.
Why this is correct
ACM automatically renews issued certificates when they are deployed on supported services, provided the domain validation remains valid, which spares engineers from manually tracking expiration dates. This automated lifecycle management is a key operational benefit because it prevents unexpected service interruptions caused by expired certificates. The renewal process works silently in the background, reissuing certificates before the current one expires, making it a primary reason organizations choose ACM.
- ✓
Integration with Elastic Load Balancing and Amazon CloudFront.
Why this is correct
ACM provides native, one-click provisioning of trusted TLS certificates to Elastic Load Balancing (both ALB and NLB) and Amazon CloudFront, eliminating the need to manually upload or manage certificate files on those services. This tight integration ensures that certificate updates, including renewals, are automatically deployed to the integrated resource without reconfiguration. The ease of associating ACM certificates to these edge and load-balancing services is a major operational benefit, especially in architectures that require secure listener configuration.
- ✗
Free certificates for use on any AWS service.
Why it's wrong here
While ACM does offer certificates at no charge, they are free only when used with supported AWS services—such as CloudFront, Elastic Load Balancing, Amazon API Gateway, and other resources compatible with ACM—not for arbitrary use on any service. For example, you cannot use an ACM certificate on an EC2 instance because the private key is not exportable, nor can you use it on an on-premises or external server. The phrase 'any AWS service' is misleading and makes this option incorrect, since ACM's free tier is constrained to its integration scope.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.