ANS-C01 Network Security, Compliance and Governance Practice Question
A company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates for an Application Load Balancer (ALB). The security team notices that an ACM-issued certificate is about to expire. How can they automate renewal?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.
ACM automatically renews certificates issued by ACM if the domain is validated with DNS or email. No manual action is needed. Imported certificates must be manually renewed. Removing and re-adding is not automatic. Lambda is unnecessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a CloudWatch alarm to send a notification when the certificate is about to expire, then manually renew.
Why it's wrong here
Automatic renewal is available; manual renewal is not required.
- ✗
Manually remove the certificate from ACM and re-issue a new one.
Why it's wrong here
Manual intervention is not needed; ACM renews automatically.
- ✓
Use AWS Certificate Manager's automatic renewal feature; no additional configuration is required if the certificate was issued by ACM.
Why this is correct
ACM automatically renews certificates it issued, provided the domain validation records are in place.
- ✗
Configure an AWS Lambda function to monitor certificate expiration and re-issue the certificate.
Why it's wrong here
ACM handles auto-renewal; Lambda is not needed.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.