Q75 — AWS SAA-C03 Ch.17

Question 75 of 89 | ← Chapter 17

Q1375. A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager(ACM) to use with public web applications.A solutions architect must implement a solution to notify the company's security team 30 days before an imported certificate expires. The company already has an Amazon SQS queue. The company also has an Amazon SNS topic that has the security team's email address as a subscriber.Which solution will provide the security team with the required notification about certificates?

Correct Answer: D. Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the rule's target.

Explanation

Let's analyze each option to determine the best solution for notifying the security team 30 days before an imported certificate expires:Option ACreating an AWS Lambda function to scan for expiring certificates and then delivering the message listing the certificates in a JSON format to an Amazon SQS queue has some drawbacks. The main purpose here is to notify the security team via email. While the SQS queue can store messages, it doesn't have a built - in mechanism to send emails directly to the security team. The security team would need an additional component (such as another Lambda function subscribed to the SQS queue) to read the messages from the queue and then send the notifications. This adds unnecessary complexity to the solution. So, this option is incorrect.Option BAlthough creating an AWS Lambda function to scan for expiring certificates and sending the JSON - formatted message to an Amazon SNS topic is a valid approach in principle, using a Lambda function for this task is an over - engineering solution. AWS already provides a native way to detect and act on certificate expiration events without the need to write and manage custom Lambda code. So, this option is not the most efficient.Option CCreating an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type and setting an Amazon SQS queue as the rule's target has the same issue as Option A. The SQS queue is not designed for sending email notifications. The security team won't receive the required email alerts directly from the SQS queue. Additional steps would be required to process the messages in the queue and send the notifications, making the solution more complex than necessary. So, this option is incorrect.Option DAmazon EventBridge is a serverless event bus service that allows you to route events between different AWS services and external sources. By creating an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type and setting the existing Amazon SNS topic (which has the security team's email address as a subscriber) as the rule's target, you can achieve the desired result. When a certificate is approaching expiration (30 days in this case), EventBridge will detect the event and send a notification to the SNS topic. The SNS topic will then forward the notification to the security team's email address. This is a simple, efficient, and native AWS solution that meets the requirement. So, this option is correct.Therefore, the solution that will provide the security team with the required notification about certificates is to create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type and set the SNS topic as the rule's target, and the answer is D.