SCS-C03 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Private Certificate Authority (AWS Private CA)

  Why this is correct

  AWS Private CA is the correct service for managing a private CA hierarchy. It allows you to issue and revoke certificates that are trusted within your organization but not by the public internet. It integrates with ACM, making it easy to deploy these private certificates to resources like Load Balancers.

• ✗

  AWS Certificate Manager (ACM) with public certificates.

  Why it's wrong here

  ACM public certificates are issued by Amazon's public CA and are trusted by browsers worldwide. However, they cannot be used for private CAs or internal-only trust chains that require custom root certificates. The requirement specifically mandates a private CA, making the public offering of ACM unsuitable for this use case.

• ✗

  AWS CloudHSM to store and manage the private keys of the web application.

  Why it's wrong here

  While CloudHSM provides high-security storage for cryptographic keys and can be used to build a CA, it is a low-level service that requires significant manual management. AWS Private CA is a fully managed service that provides the CA functionality more efficiently while still using underlying hardware security modules for protection.

• ✗

  AWS Secrets Manager to store and rotate the SSL/TLS certificates.

  Why it's wrong here

  Secrets Manager is designed for storing secrets like API keys and passwords. While it can store certificate files as strings, it is not a Certificate Authority and cannot issue or manage the lifecycle of SSL/TLS certificates. Using Secrets Manager for certificates would require manual effort that AWS Private CA automates.