SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS CloudHSM to generate a certificate and import it into ACM

  Why it's wrong here

  The AWS CloudHSM service provides hardware-backed key storage and is intended for workloads that require using an HSM for private key operations or to meet compliance mandates. Although you can generate a key pair in CloudHSM and use a CSR to obtain a publicly trusted certificate to import into ACM, doing so adds significant operational overhead: you must manage the HSM cluster, handle CA submission, and manually track rotation. Furthermore, ACM-managed certificates issued directly by ACM are renewed automatically, whereas imported certificates are not, so the HSM-based approach only creates unnecessary complexity without improving security for a standard public web application.

• ✗

  Configure CloudFront in front of the ALB and use a CloudFront default certificate

  Why it's wrong here

  Putting CloudFront in front of the ALB works for CDN use cases, but the CloudFront default certificate is a shared `*.cloudfront.net` certificate that will not match your own domain name (e.g., `www.example.com`), so browsers would still see a certificate name mismatch. To use your domain with CloudFront, you would still need to request or upload a certificate for that domain into ACM in the US East (N. Virginia) Region and attach it to the distribution. This adds an extra network hop, extra latency, and more moving parts when the ALB alone can terminate HTTPS with an ACM certificate, making it an unnecessarily complicated architecture for this scenario.

• ✗

  Generate a self-signed certificate on the EC2 instance and upload it to ACM, then associate it with the ALB

  Why it's wrong here

  A self-signed certificate does not come from a publicly trusted certificate authority, so when your ALB presents it, browsers and other clients will show a warning or refuse the connection entirely. Uploading that cert to ACM and associating it with the ALB does not change the client's trust decision — the ALB still presents the same untrusted chain. Additionally, self-signed certificates often have short validity, and you would have to manually repeat the generation/upload/association process on every rotation, whereas an ACM-issued public certificate is automatically renewed and trusted by every modern browser.

• ✓

  Request a public certificate from ACM and associate it with the ALB

  Why this is correct

  Requesting a public certificate from AWS Certificate Manager is the correct, fully managed way to implement HTTPS on an Application Load Balancer. ACM's public certificates are issued by trusted CAs (such as Amazon Trust Services), are free of charge, and are automatically renewed as long as you maintain the required DNS validation or email validation records. After ACM validates your domain, you simply attach the certificate to the ALB's HTTPS listener, and the ALB handles TLS termination. This avoids any self-managed CA infrastructure and is aligned with AWS best practices for securing a web application.

Go deeper

Related to this question