SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Secrets Manager

  Why it's wrong here

  Secrets Manager is designed to manage database credentials, API keys, and other sensitive configuration strings. It does not provide the specialized infrastructure required to serve SSL/TLS certificates for public-facing load balancers. While you could store certificates here, it lacks the integration to automatically attach them to an ALB.

• ✓

  AWS Certificate Manager (ACM)

  Why this is correct

  ACM provides a managed service to generate or import SSL/TLS certificates and associate them directly with an ALB. It handles the complexities of certificate lifecycle management, including automated renewals, ensuring that the web application maintains continuous, encrypted communication with clients without manual intervention or certificate expiration risks.

• ✗

  AWS Key Management Service (KMS)

  Why it's wrong here

  KMS is primarily used for creating and controlling cryptographic keys used to encrypt data at rest within various AWS services. It is not intended for managing public SSL/TLS certificates used for identity verification and encryption in transit for web traffic, as it lacks public certificate authority trust.

• ✗

  IAM Server Certificate Upload

  Why it's wrong here

  Uploading certificates to IAM is a legacy method used primarily for specific AWS services that do not support ACM integration. It requires manual tracking of certificate expiration dates and manual replacement, making it an operationally inefficient and insecure practice for modern ALB deployments when ACM is available.