ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Certificate Manager (ACM) to issue a public SSL/TLS certificate for a domain hosted on Route 53. The certificate is used by an Application Load Balancer. After renewal, the ALB continues to serve the old certificate. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS validation failed during renewal.
The most likely cause is that DNS validation failed during renewal. ACM attempts to automatically renew public certificates using DNS validation when the domain is in Route 53. If the DNS validation fails (e.g., due to incorrect CNAME record or permissions), the certificate will not be renewed, and the ALB will continue to serve the old certificate. Option B is incorrect because ACM automatically redeploys renewed public certificates to associated resources such as ALB listeners; no manual update is required. Option A is incorrect because ACM handles renewal and does not require import. Option C is incorrect because the certificate is public, not private.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The certificate was not imported into ACM correctly.
Why it's wrong here
Incorrect. ACM handles renewal automatically; import is not needed.
- ✗
The ALB listener is not configured to use the new certificate.
Why it's wrong here
Incorrect. ACM automatically redeploys renewed public certificates to associated resources like ALB listeners; no manual listener update is required.
- ✗
The certificate is a private certificate and cannot be used with an ALB.
Why it's wrong here
Incorrect. The certificate is public, not private, and public certificates can be used with ALB.
- ✓
DNS validation failed during renewal.
Why this is correct
Correct. DNS validation failure during renewal prevents the certificate from being renewed, causing the ALB to continue using the old certificate.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to use AWS Certificate Manager (ACM) to provide a TLS certificate for a website hosted on an ALB. The domain is example.com, and the certificate must be renewed automatically. Which type of certificate should be requested?
medium- A.A private certificate issued by ACM Private CA
- B.A self-signed certificate generated with OpenSSL
- C.A certificate imported into ACM from a third-party CA
- ✓ D.A public certificate issued by ACM with DNS validation
Why D: ACM automatically renews public certificates if DNS validation is used. Option A is incorrect because private certificates issued by ACM Private CA are not trusted by public browsers. Option B is incorrect because self-signed certificates are not trusted by browsers and must be manually renewed. Option C is incorrect because imported certificates from third-party CAs must be manually renewed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.